PT-2023-4877 · Jscape · Jscape Mft Server

Ron Bowes · CVE-2023-4528 · Published 2023-09-07 · Updated 2023-09-13

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions JSCAPE MFT Server versions prior to 2023.1.9

Description The issue is related to unsafe deserialization in the JSCAPE MFT Server, which allows an attacker to execute arbitrary Java code, including OS commands, via its management interface. This can be achieved by sending a specially crafted Java object in XML encoding. The estimated number of potentially affected devices worldwide is around 1,129, according to ZoomEye.

Recommendations For versions prior to 2023.1.9, update to version 2023.1.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the management interface to minimize the risk of exploitation. Avoid using the vulnerable deserialization mechanism until the issue is resolved.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-05368

CVE-2023-4528

Affected Products

Jscape Mft Server

References · 16

• https://jscape.com/blog/binary-management-service-patch-cve-2023-4528 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05368 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-4528 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4528 · Vendor Advisory
• https://t.me/cibsecurity/70107 · Telegram Post
• https://twitter.com/Raj_Samani/status/1700083737600365052 · Twitter Post
• https://twitter.com/rapid7/status/1699812830843715881 · Twitter Post
• https://t.me/cvenotify/57759 · Telegram Post
• https://twitter.com/ET_Labs/status/1701359523057844592 · Twitter Post
• https://rapid7.com/blog/post/2023/09/07/cve-2023-4528-java-deserialization-vulnerability-in-jscape-mft-fixed · Note
• https://twitter.com/buzz_sec/status/1699803468477653060 · Twitter Post
• https://twitter.com/iagox86/status/1699819952289783930 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1699883661368119403 · Twitter Post
• https://twitter.com/zoomeye_team/status/1701900022101733789 · Twitter Post
• https://twitter.com/Tinolle1955/status/1700249090129559703 · Twitter Post