PT-2018-17694 · Parsec+1 · Parsec+1

Paul Buonopane · Published 2018-02-05 · Updated 2019-10-09 · CVE-2018-6651

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions uncurl versions prior to 0.07 Parsec versions prior to 140-3

Description The issue is related to insufficient Origin header validation in the uncurl ws accept function, allowing remote attackers to bypass access restrictions for WebSocket API requests. This can lead to full control over the victim's computer in the context of Parsec.

Recommendations For uncurl versions prior to 0.07, update to version 0.07 or later to resolve the issue. For Parsec versions prior to 140-3, update to version 140-3 or later to resolve the issue. As a temporary workaround, consider restricting access to the WebSocket API until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-6651

Affected Products

Parsec

Uncurl

References · 5

• https://osv.dev/vulnerability/CVE-2018-6651 · Vendor Advisory
• ❌ https://github.com/chrisd1100/uncurl/commit/448cd13e7b18c83855d706c564341ddd1e38e769 · Patch, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2018-6651 · Security Note
• ❌ https://github.com/chrisd1100/uncurl/releases/tag/0.07 · Note, Deleted
• https://gist.github.com/Zenexer/ac7601c0e367d876353137e5099b18a7 · Note