PT-2023-7673 · Web2Py · Web2Py

Masashi Yamane · Publicado 2023-10-16 · Atualizado 2023-11-05 · CVE-2023-45158

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions web2py versions 2.24.1 and earlier

Description A command injection vulnerability exists in the product. When configured to use notifySendHandler for logging, a crafted web request may execute an arbitrary OS command on the web server. This issue arises due to the lack of neutralization of special elements.

Recommendations For versions 2.24.1 and earlier, consider disabling the notifySendHandler for logging until a patch is available to prevent potential exploitation. Restrict access to the web server to minimize the risk of arbitrary OS command execution. Avoid using the product with the vulnerable configuration to reduce the risk of command injection attacks.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2023-08740

CVE-2023-45158

Produtos afetados

Web2Py

Referências · 21

• 🔥 https://github.com/Evan-Zhangyf/CVE-2023-45158 · Exploit
• https://github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3 · Correção
• https://twitter.com/Komodosec/status/1714450867028726211 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-45158 · Aviso do Fabricante
• https://safe-surf.ru/specialists/bulletins-nkcki/700193 · Nota de Segurança
• https://t.me/pentestingnews/40253 · Publicação no Telegram
• http://web2py.com · Nota
• https://twitter.com/the_yellow_fall/status/1714117118122488050 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-45158 · Aviso do Fabricante
• https://twitter.com/fletch_ai/status/1714463063900889224 · Publicação no Twitter
• https://vuldb.com/ru/?id.242222 · Nota
• https://t.me/cybersecuritytechnologies/9327 · Publicação no Telegram
• https://jvn.jp/en/jp/JVN80476432 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-45158 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-08740 · Nota de Segurança