PT-2023-20448 · Teler-Waf · Teler-Waf

Aidil Arief + 1 · Published 2023-03-01 · Updated 2023-03-10 · CVE-2023-26046

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions teler-waf versions prior to 0.1.1

Description The issue exists due to teler-waf's failure to properly sanitize and filter HTML entities in user input, allowing an attacker to bypass common web attack rules and launch cross-site scripting (XSS) attacks. This enables the execution of arbitrary JavaScript code on the victim's browser, compromising the web application's security. An attacker can exploit this to steal sensitive information, such as login credentials and session tokens, or take control of the victim's browser to perform malicious actions.

Recommendations For versions prior to 0.1.1, update to version 0.1.1 to fix the vulnerability. As a temporary workaround, consider implementing additional input validation and sanitization measures to minimize the risk of exploitation. Restrict access to sensitive information and session tokens to prevent unauthorized access.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

CVE-2023-26046

GHSA-9F95-HHG4-PG4F

GO-2023-1597

Affected Products

Teler-Waf

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26046.json · Exploit
• https://github.com/kitabisa/teler-waf/commit/d1d49cfddfa3ec2adad962870f14b85cd1aaf739 · Patch
• https://github.com/kitabisa/teler-waf/security/advisories/GHSA-9f95-hhg4-pg4f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26046 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26046 · Security Note
• https://osv.dev/vulnerability/GO-2023-1597 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9f95-hhg4-pg4f · Vendor Advisory
• https://github.com/kitabisa/teler-waf/compare/v0.1.0...v0.1.1 · Note
• https://github.com/kitabisa/teler-waf/releases/tag/v0.1.1 · Note
• https://github.com/kitabisa/teler-waf · Note
• https://t.me/cvenotify/45932 · Telegram Post
• https://t.me/cibsecurity/59306 · Telegram Post
• https://t.me/cvenotify/45321 · Telegram Post
• https://github.com/advisories/GHSA-9f95-hhg4-pg4f · Note
• https://pkg.go.dev/vuln/GO-2023-1597 · Note