PT-2023-28317 · Peppermintlabs · Peppermint

Published 2023-09-18 · Updated 2023-09-21 · CVE-2023-42328

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PeppermintLabs Peppermint versions 0.2.4 and earlier

Description The issue allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded session cookie.

Recommendations For PeppermintLabs Peppermint versions 0.2.4 and earlier, consider updating to a version that does not use a hardcoded session cookie to prevent exploitation. As a temporary workaround, consider regenerating or randomizing session cookies to minimize the risk of sensitive information disclosure and arbitrary code execution.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-42328

Affected Products

Peppermint

References · 7

• 🔥 https://blockomat2100.github.io/posts/2023-09-04-damn-vulnerable-ticket-system · Exploit
• https://osv.dev/vulnerability/CVE-2023-42328 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42328 · Security Note
• https://github.com/Peppermint-Lab/peppermint/blob/446a20b870bc68157eaafcb7275c289d76bfb29e/apps/client/pages/api/auth/%5B...nextauth%5D.js#L65 · Note
• https://twitter.com/CVEnew/status/1703799253435396519 · Twitter Post
• https://peppermint.sh · Note
• https://t.me/cibsecurity/70658 · Telegram Post