PT-2023-25710 · Knowage · Knowage

Avide-Zerbetto + 1 · Publicado 2023-07-03 · Atualizado 2023-07-10 · CVE-2023-36819

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Knowage versions 6.x.x through 8.1.7

Description The issue affects the Knowage suite, allowing authenticated users to exploit the templateName parameter in the /knowage/restful-services/dossier/importTemplateFile endpoint to download any file from the system. This is possible due to the lack of sanitization of the templateName parameter, enabling an attacker to use *../* and escape the directory where templates are normally placed. The result is that a low-privileged attacker can exfiltrate sensitive configuration files.

Recommendations For Knowage versions 6.x.x through 8.1.7, update to version 8.1.8 to resolve the issue. As a temporary workaround, consider restricting access to the /knowage/restful-services/dossier/importTemplateFile endpoint until the update can be applied. Additionally, limiting the use of the templateName parameter can help minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-36819

GHSA-JW99-HXXJ-75G2

Produtos afetados

Knowage

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36819.json · Exploit
• 🔥 https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-jw99-hxxj-75g2 · Exploit
• https://t.me/cibsecurity/65874 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-36819 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-36819 · Nota de Segurança