PT-2023-16877 · Unknown · Insightcloudsec

Mike Alfaro · Published 2023-03-21 · Updated 2023-03-28 · CVE-2023-1305

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions InsightCloudSec versions prior to 23.2.1

Description An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON. This issue was resolved in the Managed and SaaS deployments on February 1, 2023.

Recommendations For versions prior to 23.2.1, update to version 23.2.1 to resolve the issue. As a temporary workaround, consider restricting access to the exposed “box” object until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-653

Related Identifiers

CVE-2023-1305

Affected Products

Insightcloudsec

References · 6

• 🔥 https://nephosec.com/exploiting-rapid7s-insightcloudsec · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-1305 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1305 · Vendor Advisory
• https://docs.divvycloud.com/changelog/23321-release-notes · Note
• https://t.me/cibsecurity/60396 · Telegram Post
• https://t.me/cvenotify/46565 · Telegram Post