PT-2023-23728 · Ckan+1 · Ckan+1

Yoloclin · Published 2023-05-24 · Updated 2023-06-03 · CVE-2023-32321

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CKAN versions prior to 2.9.9 CKAN versions prior to 2.10.1

Description CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in CKAN which may lead to remote code execution. An arbitrary file write in resource create and package update actions, using the ResourceUploader object, is possible. This vulnerability is also reachable via package create, package revise, and package patch via calls to package update. Remote code execution via unsafe pickle loading, via Beaker's session store when configured to use the file session store backend, is another issue. Potential DOS due to lack of a length check on the resource id is also a concern. Information disclosure and resource overwrite are possible if a user with permission to create a resource knows the id of another resource. A user with permissions to create or edit a dataset can upload a resource with a specially crafted id to write the uploaded file in an arbitrary location, leading to remote code execution via Beaker's insecure pickle loading.

Recommendations For CKAN versions prior to 2.9.9, upgrade to CKAN 2.9.9 or later. For CKAN versions prior to 2.10.1, upgrade to CKAN 2.10.1 or later. As a temporary workaround, consider disabling the resource create and package update actions until a patch is available. Restrict access to the ResourceUploader object to minimize the risk of exploitation. Avoid using the package create, package revise, and package patch actions via calls to package update until the issue is resolved. Consider configuring Beaker's session store to use a different backend than the file session store to mitigate the risk of remote code execution via unsafe pickle loading.

Exploit

Fix

RCE

DoS

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-32321

GHSA-446M-HMMM-HM8M

Affected Products

Beaker

Ckan

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32321.json · Exploit
• https://github.com/ckan/ckan/security/advisories/GHSA-446m-hmmm-hm8m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-32321 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-446m-hmmm-hm8m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32321 · Security Note
• https://github.com/ckan/ckan · Note
• https://github.com/ckan/ckan/blob/2a6080e61d5601fa0e2a0317afd6a8e9b7abf6dd/CHANGELOG.rst · Note
• https://t.me/cvenotify/51238 · Telegram Post
• https://t.me/cvenotify/51668 · Telegram Post
• https://t.me/cibsecurity/64734 · Telegram Post