PT-2022-11781 · Bbs · Bbs

Mysteryzo · Published 2022-03-28 · Updated 2022-04-04 · CVE-2021-43099

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions bbs version 5.3

Description The issue is related to an Archive Extraction vulnerability, also known as "Zip Slip", which exists in the UpgradeNow function in UpgradeManageAction.java. This vulnerability allows the unzipping of arbitrary uploaded zip files without checking filenames, making it possible to exploit using a specially crafted archive that holds directory traversal filenames, such as ../../evil.exe.

Recommendations For bbs version 5.3, consider disabling the UpgradeNow function in UpgradeManageAction.java until a patch is available to prevent the exploitation of this issue. Restrict access to the UpgradeManageAction.java module to minimize the risk of exploitation. Avoid using the UpgradeNow function with untrusted zip files until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-43099

Affected Products

Bbs

References · 4

• 🔥 https://github.com/diyhi/bbs/issues/51 · Exploit
• https://osv.dev/vulnerability/CVE-2021-43099 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43099 · Security Note
• https://t.me/cibsecurity/39695 · Telegram Post