PT-2023-2278 · Coredial · Sipxcom

Published 2023-03-03 · Updated 2023-04-11 · CVE-2023-25356

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CoreDial sipXcom versions up to and including 21.04

Description The issue is related to Improper Neutralization of Argument Delimiters in a Command, allowing XMPP users to inject arbitrary arguments into a system command. This can be used to read files from and write files to the sipXcom server, and can also be leveraged to gain remote command execution. The vulnerability is associated with the modification or injection of arguments in the initializePlugin function of the sipXopenfirepresence-pluginsrcorgsipfoundryopenfirepluginpresenceSipXOpenfirePlugin.java file.

Recommendations For CoreDial sipXcom versions up to and including 21.04, consider disabling the initializePlugin function as a temporary workaround until a patch is available. Restrict access to the presence-plugin to minimize the risk of exploitation. Avoid using the XMPP protocol until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

BDU:2023-02039

CVE-2023-25356

Affected Products

Sipxcom

References · 6

• 🔥 https://seclists.org/fulldisclosure/2023/Mar/5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-25356 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25356 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02039 · Security Note
• https://t.me/cibsecurity/61390 · Telegram Post
• https://vuldb.com/ru/?id.222583 · Note