PT-2023-31056 · 7 Zip · 7Za

Maride + 1 · Published 2023-11-22 · Updated 2024-08-02 · CVE-2023-49102

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NZBGet version 21.1

Description The issue allows authenticated remote code execution due to the unarchive programs (7za and unrar) preserving executable file permissions. An attacker with Control capability can execute a file by setting the value of SevenZipCommand or UnrarCmd. This issue only affects products that are no longer supported by the maintainer.

Recommendations For NZBGet version 21.1, consider disabling the SevenZipCommand and UnrarCmd settings to prevent exploitation until a patch is available. Restrict access to the unarchive programs (7za and unrar) to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2023-49102

Affected Products

7Za

References · 6

• 🔥 https://sec.maride.cc/posts/nzbget · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-49102 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49102 · Vendor Advisory
• https://nzbget.net/download · Note
• https://t.me/cvenotify/61905 · Telegram Post
• https://t.me/cvenotify/88660 · Telegram Post