PT-2023-19465 · Urule · Urule

Idam0N · Publicado 2023-02-24 · Atualizado 2023-03-06 · CVE-2023-24189

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions urule version 2.1.7

Description An XML External Entity (XXE) issue allows attackers to execute arbitrary code by uploading a crafted XML file to the "/urule/common/saveFile" API endpoint. This is achieved by exploiting the saveFile functionality, potentially allowing for unauthorized access and code execution.

Recommendations For urule version 2.1.7, consider disabling the saveFile functionality or restricting access to the "/urule/common/saveFile" API endpoint until a patch is available. Avoid using this endpoint with untrusted or unvalidated XML files to minimize the risk of exploitation.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2023-24189

Produtos afetados

Urule

Referências · 5

• 🔥 https://github.com/Venus-WQLab/bug_report/blob/main/ureport/ureport-cve-2023-24189.md · Exploit
• https://github.com/youseries/urule · Nota
• https://t.me/cibsecurity/58895 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-24189 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-24189 · Aviso do Fabricante