PT-2023-6726 · Unknown · Webui-Aria2

Jafarakhondali · Publicado 2023-08-22 · Atualizado 2024-10-14 · CVE-2023-39141

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions webui-aria2 version 4fe2e

Description The issue is related to a path traversal vulnerability in the WebUI-Aria2 interface. This vulnerability is due to incorrect restriction of the directory path name with limited access. Exploitation of this issue may allow a remote attacker to disclose protected information.

Recommendations For version 4fe2e, consider restricting access to sensitive directories to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Path traversal

Enumeração de Fraquezas

CWE-400

CWE-22

Identificadores relacionados

BDU:2023-07502

CVE-2023-39141

GHSA-CRV8-R5WQ-GV2W

Produtos afetados

Webui-Aria2

Referências · 10

• 🔥 https://gist.github.com/JafarAkhondali/528fe6c548b78f454911fb866b23f66e · Exploit
• https://github.com/ziahamza/webui-aria2/blob/109903f0e2774cf948698cd95a01f77f33d7dd2c/node-server.js#L10 · Nota
• https://github.com/ziahamza/webui-aria2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-39141 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-07502 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-crv8-r5wq-gv2w · Aviso do Fabricante
• https://t.me/cybersecuritytechnologies/8944 · Publicação no Telegram
• https://t.me/cibsecurity/68965 · Publicação no Telegram
• https://twitter.com/kr3ypt0n/status/1801323061742080294 · Publicação no Twitter
• https://twitter.com/DjalilAyed/status/1845833679265828967 · Publicação no Twitter