PT-2023-31056 · 7 Zip · 7Za

Maride + 1 · Publicado 2023-11-22 · Atualizado 2024-08-02 · CVE-2023-49102

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NZBGet version 21.1

Description The issue allows authenticated remote code execution due to the unarchive programs (7za and unrar) preserving executable file permissions. An attacker with Control capability can execute a file by setting the value of SevenZipCommand or UnrarCmd. This issue only affects products that are no longer supported by the maintainer.

Recommendations For NZBGet version 21.1, consider disabling the SevenZipCommand and UnrarCmd settings to prevent exploitation until a patch is available. Restrict access to the unarchive programs (7za and unrar) to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2023-49102

Produtos afetados

7Za

Referências · 6

• 🔥 https://sec.maride.cc/posts/nzbget · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-49102 · Nota de Segurança
• https://nzbget.net/download · Nota
• https://t.me/cvenotify/61905 · Publicação no Telegram
• https://t.me/cvenotify/88660 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-49102 · Aviso do Fabricante