PT-2022-7070 · Unknown · Linuxasmcallgraph

Bjrjk + 1 · Published 2022-02-08 · Updated 2023-08-10 · CVE-2023-39346

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LinuxASMCallGraph versions prior to commit 20dba06bd1a3cf260612d4f21547c25002121cd5

Description The issue is related to incorrect filtering rules of uploaded files, allowing attackers to cause remote code execution on the server side via uploading a crafted ZIP file. This can be exploited by uploading a specially crafted ZIP file, enabling an attacker to execute arbitrary code remotely.

Recommendations For versions prior to commit 20dba06bd1a3cf260612d4f21547c25002121cd5, update to a version that includes the patch from commit 20dba06bd1a3cf260612d4f21547c25002121cd5 to resolve the issue. As a temporary workaround, consider restricting the upload of ZIP files or implementing additional filtering rules for uploaded files to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2023-07469

CVE-2023-39346

GHSA-63C3-R9QM-C2WX

Affected Products

Linuxasmcallgraph

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39346.json · Exploit
• https://github.com/bjrjk/LinuxASMCallGraph/commit/20dba06bd1a3cf260612d4f21547c25002121cd5 · Patch
• https://github.com/bjrjk/LinuxASMCallGraph/security/advisories/GHSA-63c3-r9qm-c2wx · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07469 · Security Note
• https://osv.dev/vulnerability/CVE-2023-39346 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39346 · Security Note
• https://github.com/bjrjk/LinuxASMCallGraph · Note
• https://github.com/bjrjk/LinuxASMCallGraph/issues/6 · Note
• https://github.com/bjrjk/LinuxASMCallGraph/issues/8 · Note
• https://t.me/cibsecurity/67811 · Telegram Post