PT-2023-27237 · Chef · Chef Automate

Published 2023-10-31 · Updated 2023-11-08 · CVE-2023-40050

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chef Automate versions prior to and including 4.10.29

Description The issue allows remote code execution when uploading a profile through the API or user interface in Chef Automate using the InSpec check command with a maliciously crafted profile.

Recommendations For Chef Automate versions prior to and including 4.10.29, update to a version later than 4.10.29 to resolve the issue. As a temporary workaround, consider restricting the use of the InSpec check command until a patch is available. Avoid using maliciously crafted profiles in the affected API endpoint until the issue is resolved.

Fix

Unrestricted File Upload

Code Injection

Weakness Enumeration

CWE-434

CWE-94

Related Identifiers

CVE-2023-40050

Affected Products

Chef Automate

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-40050 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40050 · Vendor Advisory
• https://community.progress.com/s/article/Product-Alert-Bulletin-October-2023-CHEF-Automate-CVE-2023-40050 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1719392131544985801 · Twitter Post
• https://docs.chef.io/automate/profiles · Note
• https://docs.chef.io/release_notes_automate · Note