PT-2023-19069 · Erohtar · Dasherr

Beauknowstech · Published 2023-01-20 · Updated 2023-02-03 · CVE-2023-23607

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions erohtar/Dasherr versions prior to 1.05.00

Description The issue allows any unauthenticated user to execute arbitrary code on the server due to unrestricted file upload. The file /www/include/filesave.php enables uploading files to anywhere on the server. If an attacker uploads a php file, they can execute code on the server.

Recommendations For versions prior to 1.05.00, upgrade to version 1.05.00 to address the issue. As a temporary workaround, consider restricting access to the /www/include/filesave.php file to prevent unauthorized file uploads. Additionally, avoid uploading php files to the server until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-23607

GHSA-6RGC-2X44-7PHQ

Affected Products

Dasherr

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23607.json · Exploit
• 🔥 https://github.com/erohtar/Dasherr/security/advisories/GHSA-6rgc-2x44-7phq · Exploit
• https://github.com/erohtar/Dasherr/commit/445325c7cf1148a8cd38af3a90789c6cbf6c5112 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-23607 · Security Note
• https://osv.dev/vulnerability/CVE-2023-23607 · Vendor Advisory
• https://t.me/cvenotify/42586 · Telegram Post
• https://t.me/cibsecurity/56795 · Telegram Post
• https://vicarius.io/vsociety/posts/analyzing-arbitrary-file-upload-in-dasherr-cve-2023-23607-23608 · Note