PT-2023-21922 · General Bytes · General Bytes Crypto Application Server

Published 2023-03-21 · Updated 2023-03-27 · CVE-2023-28725

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions General Bytes Crypto Application Server (CAS) versions prior to 20221118.48 General Bytes Crypto Application Server (CAS) versions prior to 20230120.44

Description The issue allows remote attackers to execute arbitrary Java code by uploading a Java application to the "/batm/app/admin/standalone/deployments" directory. This has been exploited in the wild in March 2023.

Recommendations For versions prior to 20221118.48, update to version 20221118.48 or later. For versions prior to 20230120.44, update to version 20230120.44 or later. As a temporary workaround, consider restricting access to the "/batm/app/admin/standalone/deployments" directory until a patch is applied.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-28725

Affected Products

General Bytes Crypto Application Server

References · 12

• 🔥 https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/2885222430/Security+Incident+March+17-18th+2023 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-28725 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28725 · Vendor Advisory
• https://generalbytes.com/en/support/changelog · Note
• https://t.me/cvenotify/46594 · Telegram Post
• https://t.me/cibsecurity/60428 · Telegram Post
• https://web3isgoinggreat.com/single/general-bytes-crypto-atms-exploited-for-over-1-6-million · Note
• https://twitter.com/generalbytes/status/1637192687160897537 · Note
• https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/951418958/Update+CAS · Note
• https://arstechnica.com/information-technology/2023/03/hackers-drain-bitcoin-atms-of-1-5-million-by-exploiting-0-day-bug · Note
• https://t.me/cvenotify/46606 · Telegram Post
• https://bleepingcomputer.com/news/security/general-bytes-bitcoin-atms-hacked-using-zero-day-15m-stolen · Note