PT-2023-4489 · Iagona · Iagona Scrutisweb

Jorian Van Den Hout + 2 · Published 2023-07-18 · Updated 2023-08-17 · CVE-2023-35189

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Iagona ScrutisWeb versions 2.1.37 and prior

Description The issue is related to a remote code execution vulnerability that could allow an unauthenticated user to upload a malicious payload and execute it. This is due to an unlimited file upload of dangerous types, which can be exploited by a remote attacker to execute arbitrary code by uploading an arbitrary file.

Recommendations For Iagona ScrutisWeb versions 2.1.37 and prior, consider disabling the file upload feature until a patch is available to prevent exploitation of the remote code execution vulnerability. Restrict access to the affected module to minimize the risk of exploitation. Avoid using the file upload functionality in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2023-04885

CVE-2023-35189

Affected Products

Iagona Scrutisweb

References · 10

• https://osv.dev/vulnerability/CVE-2023-35189 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35189 · Security Note
• https://bdu.fstec.ru/vul/2023-04885 · Security Note
• https://twitter.com/CyberSec84/status/1692207699310596215 · Twitter Post
• https://twitter.com/raasangandhi/status/1691166932546764800 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-199-03 · Note
• https://t.me/cibsecurity/66948 · Telegram Post
• https://github.com/advisories/GHSA-pgr9-q3w5-6ffh · Note
• https://twitter.com/fletch_ai/status/1691602419573006381 · Twitter Post
• https://t.me/echeloneyes/1854 · Telegram Post