PT-2023-31619 · Unknown · Speckle Server

Fabis94 + 1 · Published 2023-12-14 · Updated 2023-12-28 · CVE-2023-50713

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Speckle Server versions prior to 2.17.6

Description A vulnerability affects users who authorized an application with 'token write' scope or created a Personal Access Token (PAT) with token write scope. The issue allows a malicious actor to generate further tokens with additional privileges, up to the existing privileges of the user, using a token with only token write scope. This cannot be used to escalate a user's privileges or grant privileges on behalf of other users.

Recommendations For versions prior to 2.17.6, upgrade the server to version 2.17.6 or higher. Review existing tokens and permanently revoke any unrecognized tokens. Revoke existing tokens and create new tokens. Review usage of the account for suspicious activity.

Exploit

Fix

Weakness Enumeration

CWE-1220

Related Identifiers

CVE-2023-50713

GHSA-XPF3-5Q5X-3QWH

Affected Products

Speckle Server

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50713.json · Exploit
• https://github.com/specklesystems/speckle-server/commit/3689e1cd58ec4f06abee836af34889d6ce474571 · Patch
• https://osv.dev/vulnerability/CVE-2023-50713 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50713 · Security Note
• https://github.com/specklesystems/speckle-server/security/advisories/GHSA-xpf3-5q5x-3qwh · Note
• https://github.com/specklesystems/speckle-server/releases/tag/2.17.6 · Note
• https://twitter.com/CVEnew/status/1735369060756668516 · Twitter Post