PT-2023-20448 · Teler-Waf · Teler-Waf

Aidil Arief + 1 · Publicado 2023-03-01 · Atualizado 2023-03-10 · CVE-2023-26046

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions teler-waf versions prior to 0.1.1

Description The issue exists due to teler-waf's failure to properly sanitize and filter HTML entities in user input, allowing an attacker to bypass common web attack rules and launch cross-site scripting (XSS) attacks. This enables the execution of arbitrary JavaScript code on the victim's browser, compromising the web application's security. An attacker can exploit this to steal sensitive information, such as login credentials and session tokens, or take control of the victim's browser to perform malicious actions.

Recommendations For versions prior to 0.1.1, update to version 0.1.1 to fix the vulnerability. As a temporary workaround, consider implementing additional input validation and sanitization measures to minimize the risk of exploitation. Restrict access to sensitive information and session tokens to prevent unauthorized access.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

CWE-80

Identificadores relacionados

CVE-2023-26046

GHSA-9F95-HHG4-PG4F

GO-2023-1597

Produtos afetados

Teler-Waf

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26046.json · Exploit
• https://github.com/kitabisa/teler-waf/compare/v0.1.0...v0.1.1 · Nota
• https://github.com/kitabisa/teler-waf/commit/d1d49cfddfa3ec2adad962870f14b85cd1aaf739 · Correção
• https://github.com/kitabisa/teler-waf/security/advisories/GHSA-9f95-hhg4-pg4f · Aviso do Fabricante
• https://github.com/kitabisa/teler-waf/releases/tag/v0.1.1 · Nota
• https://github.com/kitabisa/teler-waf · Nota
• https://osv.dev/vulnerability/CVE-2023-26046 · Aviso do Fabricante
• https://t.me/cvenotify/45932 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-26046 · Nota de Segurança
• https://osv.dev/vulnerability/GO-2023-1597 · Aviso do Fabricante
• https://t.me/cibsecurity/59306 · Publicação no Telegram
• https://t.me/cvenotify/45321 · Publicação no Telegram
• https://github.com/advisories/GHSA-9f95-hhg4-pg4f · Nota
• https://pkg.go.dev/vuln/GO-2023-1597 · Nota
• https://osv.dev/vulnerability/GHSA-9f95-hhg4-pg4f · Aviso do Fabricante