PT-2023-20167 · Apollo · Apollo

Nobodyiam · Published 2023-02-20 · Updated 2023-03-01 · CVE-2023-25569

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apollo versions prior to 2.1.0

Description A low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. The issue is related to the Cookie SameSite strategy, which was set to Lax in version 2.1.0.

Recommendations For versions prior to 2.1.0, update to version 2.1.0 or later to resolve the issue. As a temporary workaround, avoid visiting unknown source pages to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-25569

GHSA-FMXQ-V8MG-QH25

Affected Products

Apollo

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25569.json · Exploit
• https://github.com/apolloconfig/apollo/pull/4664 · Patch
• https://github.com/apolloconfig/apollo/commit/00d968a7229f809b0d8ed0532e8c01a6c2b7c750 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-25569 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25569 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fmxq-v8mg-qh25 · Vendor Advisory
• https://github.com/apolloconfig/apollo · Note
• https://github.com/apolloconfig/apollo/releases/tag/v2.1.0 · Note
• https://github.com/apolloconfig/apollo/security/advisories/GHSA-fmxq-v8mg-qh25 · Note
• https://t.me/cvenotify/44683 · Telegram Post
• https://apolloconfig.com/#/en/usage/apollo-user-guide?id=_71-security-related · Note
• https://t.me/cibsecurity/58526 · Telegram Post