PT-2023-28807 · Searchor · Searchor

Nikn0Laty · Publicado 2023-09-25 · Atualizado 2025-02-01 · CVE-2023-43364

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Searchor versions prior to 2.4.2

Description The issue allows an attacker to execute arbitrary code via a crafted script to the eval() function in Searchor's main.py file, affecting the search feature in Searchor's Command Line Interface. This may cause unexpected code execution.

Recommendations For versions prior to 2.4.2, update to version 2.4.2 or later to resolve the issue. As a temporary workaround, consider disabling the eval() function in main.py until a patch is available. Restrict access to the main.py file to minimize the risk of exploitation. Avoid using the eval() function in the Command Line Interface until the issue is resolved.

Exploit

Correção

Special Elements Injection

Code Injection

Enumeração de Fraquezas

CWE-74

CWE-94

Identificadores relacionados

CVE-2023-43364

GHSA-66M2-493M-CRH2

PYSEC-2023-262

Produtos afetados

Searchor

Referências · 14

• 🔥 https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection · Exploit
• 🔥 https://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit- · Exploit
• https://github.com/pypa/advisory-database/tree/main/vulns/searchor/PYSEC-2023-262.yaml · Nota
• https://github.com/ArjunSharda/Searchor/commit/16016506f7bf92b0f21f51841d599126d6fcd15b · Correção
• https://github.com/ArjunSharda/Searchor/pull/130 · Correção
• https://github.com/ArjunSharda/Searchor · Nota
• https://github.com/ArjunSharda/Searchor/security/advisories/GHSA-66m2-493m-crh2 · Nota
• https://github.com/advisories/GHSA-66m2-493m-crh2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-43364 · Nota de Segurança
• https://twitter.com/CVEnew/status/1734629324937187412 · Publicação no Twitter
• https://osv.dev/vulnerability/PYSEC-2023-262 · Aviso do Fabricante
• https://twitter.com/hexadivine/status/1885669431982096431 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-43364 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-66m2-493m-crh2 · Aviso do Fabricante