PT-2022-3952 · Unknown · Ossn Open Source Social Network

Published 2022-07-25 · Updated 2024-08-03 · CVE-2022-34965

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Open Source Social Network version 6.3 LTS

Description The issue is related to an arbitrary file upload vulnerability in the /ossn/administrator/com installer component. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. Note that the project owner believes this behavior is intended, as it only allows authenticated admins to upload files.

Recommendations For version 6.3 LTS, consider restricting access to the /ossn/administrator/com installer component to minimize the risk of exploitation. As a temporary workaround, consider disabling the file upload functionality in this component until a patch is available. Restrict access to the vulnerable component to only authenticated admins to reduce the risk of arbitrary code execution.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2022-04784

CVE-2022-34965

Affected Products

Ossn Open Source Social Network

References · 12

• 🔥 https://grimthereaperteam.medium.com/cve-2022-34965-open-source-social-network-6-3-3f61db82880 · Exploit
• https://opensource-socialnetwork.org · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34965 · Security Note
• https://bdu.fstec.ru/vul/2022-04784 · Security Note
• https://openteknik.com/contact?channel=ossn · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34965 · Vendor Advisory
• https://github.com/opensource-socialnetwork/opensource-socialnetwork/releases/tag/6.3 · Note
• https://t.me/cvenotify/86425 · Telegram Post
• https://t.me/cvenotify/88746 · Telegram Post
• https://t.me/cibsecurity/46941 · Telegram Post
• https://t.me/cvenotify/79088 · Telegram Post
• https://t.me/cvenotify/33745 · Telegram Post