PT-2023-7469 · Openssl · Openssl

CVE-2023-49210 · Publicado 2023-11-23 · Atualizado 2024-08-02

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions openssl (aka node-openssl) versions through 2.0.0

Description The issue is related to the absence of input data sanitization in the openssl package of the NPM package manager. This allows a remote attacker to execute arbitrary commands by exploiting the vulnerability. The vulnerability only affects products that are no longer supported by the maintainer. There are elevated activities targeting this issue.

Recommendations For versions through 2.0.0, consider disabling the verb field in the opts argument to prevent command execution until a fix is available. Restrict access to the opts argument to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2023-08512

CVE-2023-49210

GHSA-75W2-QV55-X7FV

Produtos afetados

Openssl

Referências · 12

• 🔥 https://gist.github.com/mcoimbra/b05a55a5760172dccaa0a827647ad63e · Exploit
• https://github.com/ossf/malicious-packages/tree/main/malicious/npm · Correção
• https://t.me/cvenotify/88661 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-49210 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-49210 · Nota de Segurança
• https://npmjs.com/package/openssl · Nota
• https://bdu.fstec.ru/vul/2023-08512 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-75w2-qv55-x7fv · Aviso do Fabricante
• https://t.me/cvenotify/61058 · Publicação no Telegram
• https://twitter.com/vuldb/status/1797906652785701165 · Publicação no Twitter
• https://security.snyk.io/vuln/SNYK-JS-OPENSSL-6084018 · Nota
• https://vuldb.com/ru/?id.246092 · Nota