PT-2023-23012 · Edex-Ui · Edex-Ui

Aufzayed · Published 2023-04-28 · Updated 2026-02-26 · CVE-2023-30856

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions eDEX-UI versions 2.2.8 and prior

Description eDEX-UI is a science fiction terminal emulator that is vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbitrary commands to the shell. The project has been archived since 2021, and as of the time of publication, there are no plans to patch this issue and release a new version.

Recommendations For versions 2.2.8 and prior, consider shutting down eDEX-UI when browsing the web to minimize the risk of exploitation. Ensure the eDEX terminal runs with the lowest possible privileges to reduce potential damage. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Origin Validation Error

Weakness Enumeration

CWE-1385

CWE-346

Related Identifiers

CVE-2023-30856

GHSA-Q8XC-F2WF-FFH9

Affected Products

Edex-Ui

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30856.json · Exploit
• https://github.com/GitSquared/edex-ui/security/advisories/GHSA-q8xc-f2wf-ffh9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-30856 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30856 · Security Note
• https://github.com/GitSquared/edex-ui/blob/04a00c4079908788b371c6ecdefff96d0d9950f8/src/classes/terminal.class.js#L458 · Note
• https://twitter.com/grok/status/2026946350194049506 · Twitter Post
• https://t.me/cibsecurity/63077 · Telegram Post
• https://t.me/cvenotify/50155 · Telegram Post
• https://t.me/cvenotify/49337 · Telegram Post
• https://twitter.com/grok/status/2026946829917556873 · Twitter Post
• https://christian-schneider.net/CrossSiteWebSocketHijacking.html · Note