PT-2023-8202 · Opnsense · Opnsense

Feliks Penconek · Publicado 2023-06-28 · Atualizado 2024-02-22 · CVE-2023-38997

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2

Description A directory traversal vulnerability exists in the Captive Portal templates of OPNsense, allowing attackers to execute arbitrary system commands as root via a crafted ZIP archive. This issue arises due to incorrect restriction of the directory path name with limited access. Exploitation of this vulnerability may enable a remote attacker to execute arbitrary commands with root privileges using a specially crafted ZIP archive.

Recommendations For OPNsense Community Edition versions prior to 23.7, update to version 23.7 or later to resolve the issue. For OPNsense Business Edition versions prior to 23.4.2, update to version 23.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Captive Portal templates until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2024-00194

CVE-2023-38997

Produtos afetados

Opnsense

Referências · 7

• 🔥 https://logicaltrust.net/blog/2023/08/opnsense.html · Exploit
• https://github.com/opnsense/core/commit/448762d440b51574f1906c0ec2f5ea6dc4f16eb2 · Correção
• https://t.me/cvenotify/56141 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-38997 · Aviso do Fabricante
• https://t.me/cvenotify/72228 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2024-00194 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-38997 · Nota de Segurança