PT-2023-16878 · Unknown · Insightcloudsec

Mike Alfaro · Publicado 2023-03-21 · Atualizado 2023-03-28 · CVE-2023-1306

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InsightCloudSec versions prior to 23.2.1

Description An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which can lead to code execution. This issue was resolved in the Managed and SaaS deployments on February 1, 2023.

Recommendations For versions prior to 23.2.1, update to version 23.2.1 to resolve the issue. As a temporary workaround, consider restricting access to the resource.db() accessor method until a patch is available.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2023-1306

Produtos afetados

Insightcloudsec

Referências · 6

• 🔥 https://nephosec.com/exploiting-rapid7s-insightcloudsec · Exploit
• https://t.me/cibsecurity/60397 · Publicação no Telegram
• https://docs.divvycloud.com/changelog/23321-release-notes · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-1306 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-1306 · Aviso do Fabricante
• https://t.me/cvenotify/46564 · Publicação no Telegram