PT-2023-6510 · Unknown · Whitehsbg Jndiexploit

Kaikaix · Publicado 2023-09-29 · Atualizado 2024-06-05 · CVE-2023-5257

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Média

Vetor base

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WhiteHSBG JNDIExploit version 1.4

Description A vulnerability was found in the function handleFileRequest of the file src/main/java/com/feihong/ldap/HTTPServer.java. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. This issue is related to insufficient restrictions on directory path names in the Java Naming and Directory Interface (JNDI) JNDIExploit tool.

Recommendations As a temporary workaround, consider disabling the handleFileRequest function until a patch is available. Restrict access to the HTTPServer.java file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2023-07257

CVE-2023-5257

Produtos afetados

Whitehsbg Jndiexploit

Referências · 11

• 🔥❌ https://github.com/WhiteHSBG/JNDIExploit/issues/10 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2023-5257 · Nota de Segurança
• https://vuldb.com/?ctiid.240866 · Nota
• https://t.me/cvenotify/82123 · Publicação no Telegram
• https://t.me/cibsecurity/71278 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1707710048309256272 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-5257 · Aviso do Fabricante
• https://vuldb.com/?id.240866 · Nota
• https://t.me/cvenotify/58766 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1707741225820852734 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-07257 · Nota de Segurança