PT-2023-19465 · Urule · Urule

Idam0N · Published 2023-02-24 · Updated 2023-03-06 · CVE-2023-24189

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions urule version 2.1.7

Description An XML External Entity (XXE) issue allows attackers to execute arbitrary code by uploading a crafted XML file to the "/urule/common/saveFile" API endpoint. This is achieved by exploiting the saveFile functionality, potentially allowing for unauthorized access and code execution.

Recommendations For urule version 2.1.7, consider disabling the saveFile functionality or restricting access to the "/urule/common/saveFile" API endpoint until a patch is available. Avoid using this endpoint with untrusted or unvalidated XML files to minimize the risk of exploitation.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2023-24189

Affected Products

Urule

References · 5

• 🔥 https://github.com/Venus-WQLab/bug_report/blob/main/ureport/ureport-cve-2023-24189.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-24189 · Security Note
• https://osv.dev/vulnerability/CVE-2023-24189 · Vendor Advisory
• https://github.com/youseries/urule · Note
• https://t.me/cibsecurity/58895 · Telegram Post