PT-2023-21856 · Zulip · Zulip

Alexmv · Published 2023-05-19 · Updated 2023-05-26 · CVE-2023-28623

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zulip versions prior to 6.2

Description Zulip is an open-source team collaboration tool with unique topic-based threading. An attacker can create a new account in the organization with an arbitrary email address in their control that's not in the organization's LDAP directory, given that ZulipLDAPAuthBackend and an external authentication backend are the only ones enabled in AUTHENTICATION BACKENDS in /etc/zulip/settings.py and the organization permissions don't require invitations to join. The impact is limited to installations with this specific combination of authentication backends and having Invitations are required for joining this organization organization permission disabled.

Recommendations For versions prior to 6.2, upgrade to version 6.2 to address the issue. As a temporary workaround for users unable to upgrade, enable the Invitations are required for joining this organization organization permission to prevent this issue.

Exploit

Fix

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

CVE-2023-28623

GHSA-7P62-PJWG-56RV

Affected Products

Zulip

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28623.json · Exploit
• https://github.com/zulip/zulip/commit/3df1b4dd7c210c21deb6f829df19412b74573f8d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-28623 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28623 · Vendor Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-7p62-pjwg-56rv · Note
• https://t.me/cvenotify/50822 · Telegram Post
• https://t.me/cvenotify/51203 · Telegram Post
• https://t.me/cibsecurity/64475 · Telegram Post