PT-2023-23012 · Edex-Ui · Edex-Ui

Aufzayed · Publicado 2023-04-28 · Atualizado 2026-02-26 · CVE-2023-30856

Positive Technologies (AI Summary)

CVSS v3.1

8.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions eDEX-UI versions 2.2.8 and prior

Description eDEX-UI is a science fiction terminal emulator that is vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbitrary commands to the shell. The project has been archived since 2021, and as of the time of publication, there are no plans to patch this issue and release a new version.

Recommendations For versions 2.2.8 and prior, consider shutting down eDEX-UI when browsing the web to minimize the risk of exploitation. Ensure the eDEX terminal runs with the lowest possible privileges to reduce potential damage. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Origin Validation Error

Enumeração de Fraquezas

CWE-1385

CWE-346

Identificadores relacionados

CVE-2023-30856

GHSA-Q8XC-F2WF-FFH9

Produtos afetados

Edex-Ui

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30856.json · Exploit
• https://github.com/GitSquared/edex-ui/blob/04a00c4079908788b371c6ecdefff96d0d9950f8/src/classes/terminal.class.js#L458 · Nota
• https://github.com/GitSquared/edex-ui/security/advisories/GHSA-q8xc-f2wf-ffh9 · Aviso do Fabricante
• https://twitter.com/grok/status/2026946350194049506 · Publicação no Twitter
• https://t.me/cibsecurity/63077 · Publicação no Telegram
• https://t.me/cvenotify/50155 · Publicação no Telegram
• https://t.me/cvenotify/49337 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-30856 · Aviso do Fabricante
• https://twitter.com/grok/status/2026946829917556873 · Publicação no Twitter
• https://christian-schneider.net/CrossSiteWebSocketHijacking.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-30856 · Nota de Segurança