PT-2023-20449 · Teler-Waf · Teler-Waf

Aidil Arief + 1 · Published 2023-03-01 · Updated 2023-03-10 · CVE-2023-26047

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions teler-waf versions prior to 0.2.0

Description teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. The issue allows an attacker to execute arbitrary JavaScript code on the victim's browser and compromise the security of the web application when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used. An attacker can exploit this to bypass common web attack threat rules in teler-waf and launch cross-site scripting (XSS) attacks, potentially stealing sensitive information or taking control of the victim's browser.

Recommendations For versions prior to 0.2.0, update to version 0.2.0 or later to patch the vulnerability. As a temporary workaround, consider restricting the handling of special characters in payloads until the update can be applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-692

CWE-80

Related Identifiers

CVE-2023-26047

GHSA-P2PF-G8CQ-3GQ5

GO-2023-1600

Affected Products

Teler-Waf

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26047.json · Exploit
• https://github.com/dwisiswant0/cwa-filter-rules/commit/d818d1645832d1a02cd210c7680e692d2bf4313b · Patch
• https://osv.dev/vulnerability/GHSA-p2pf-g8cq-3gq5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26047 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26047 · Security Note
• https://osv.dev/vulnerability/GO-2023-1600 · Vendor Advisory
• https://github.com/kitabisa/teler-waf/compare/v0.1.2...v0.2.0 · Note
• https://github.com/kitabisa/teler-waf/security/advisories/GHSA-p2pf-g8cq-3gq5 · Note
• https://github.com/kitabisa/teler-waf/releases/tag/v0.2.0 · Note
• https://github.com/kitabisa/teler-waf/commit/6e1b0e19b8adc1bbc3513a986025d4adf88d59f8 · Note
• https://github.com/kitabisa/teler-waf · Note
• https://github.com/advisories/GHSA-p2pf-g8cq-3gq5 · Note
• https://pkg.go.dev/vuln/GO-2023-1600 · Note
• https://t.me/cibsecurity/59410 · Telegram Post