PT-2023-28807 · Searchor · Searchor

Nikn0Laty · Published 2023-09-25 · Updated 2025-02-01 · CVE-2023-43364

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Searchor versions prior to 2.4.2

Description The issue allows an attacker to execute arbitrary code via a crafted script to the eval() function in Searchor's main.py file, affecting the search feature in Searchor's Command Line Interface. This may cause unexpected code execution.

Recommendations For versions prior to 2.4.2, update to version 2.4.2 or later to resolve the issue. As a temporary workaround, consider disabling the eval() function in main.py until a patch is available. Restrict access to the main.py file to minimize the risk of exploitation. Avoid using the eval() function in the Command Line Interface until the issue is resolved.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2023-43364

GHSA-66M2-493M-CRH2

PYSEC-2023-262

Affected Products

Searchor

References · 14

• 🔥 https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection · Exploit
• 🔥 https://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit- · Exploit
• https://github.com/ArjunSharda/Searchor/commit/16016506f7bf92b0f21f51841d599126d6fcd15b · Patch
• https://github.com/ArjunSharda/Searchor/pull/130 · Patch
• https://github.com/advisories/GHSA-66m2-493m-crh2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43364 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-262 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-43364 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-66m2-493m-crh2 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/searchor/PYSEC-2023-262.yaml · Note
• https://github.com/ArjunSharda/Searchor · Note
• https://github.com/ArjunSharda/Searchor/security/advisories/GHSA-66m2-493m-crh2 · Note
• https://twitter.com/CVEnew/status/1734629324937187412 · Twitter Post
• https://twitter.com/hexadivine/status/1885669431982096431 · Twitter Post