PT-2023-27215 · Unknown · Privateuploader

Spysder · Published 2023-08-14 · Updated 2023-08-22 · CVE-2023-40020

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrivateUploader versions prior to 3.2.49

Description PrivateUploader is an open source image hosting server written in Vue and TypeScript. In affected versions, the app/routes/v3/admin.controller.ts file did not correctly verify whether the user was an administrator or moderator, causing the request to continue processing. The response would be a 403 with ADMIN ONLY, however, next() would call, leading to any updates/changes in the route to process.

Recommendations For versions prior to 3.2.49, upgrade to version 3.2.49 to address the issue. As a temporary workaround, consider restricting access to the admin.controller.ts file until the upgrade is applied. There are no known workarounds for this issue other than upgrading to the fixed version.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-40020

GHSA-VHRW-2472-RRJX

Affected Products

Privateuploader

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40020.json · Exploit
• https://github.com/PrivateUploader/PrivateUploader/commit/869657d61e3c7a518177106fe63ea483082b0d3e · Patch
• https://github.com/PrivateUploader/PrivateUploader/security/advisories/GHSA-vhrw-2472-rrjx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40020 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40020 · Vendor Advisory
• https://t.me/cibsecurity/68482 · Telegram Post
• https://t.me/cvenotify/56460 · Telegram Post
• https://twitter.com/cracbot/status/1691328949018865664 · Twitter Post
• https://t.me/cvenotify/57063 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1691222059290910720 · Twitter Post
• https://twitter.com/CVEnew/status/1691181808082108418 · Twitter Post