PT-2023-4975 · Visualware · Visualware Myconnection Server

Published 2023-09-08 · Updated 2024-05-04 · CVE-2023-42033

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Visualware MyConnection Server (affected versions not specified)

Description The issue is related to the doPostUploadfiles method in Visualware MyConnection Server, which is vulnerable to directory traversal and remote code execution. This is due to the lack of proper validation of a user-supplied path prior to using it in file operations. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. An attacker can leverage this vulnerability to execute code in the context of root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the doPostUploadfiles method until a patch is available. Restrict access to sensitive areas of the server to minimize the risk of exploitation. Avoid using user-supplied paths in file operations until the issue is resolved.

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-05514

CVE-2023-42033

ZDI-23-1396

Affected Products

Visualware Myconnection Server

References · 7

• https://zerodayinitiative.com/advisories/ZDI-23-1396 · Security Note
• https://myconnectionserver.visualware.com/support/security-advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42033 · Security Note
• https://osv.dev/vulnerability/CVE-2023-42033 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05514 · Security Note
• https://twitter.com/CVEnew/status/1786822830581256593 · Twitter Post
• https://zerodayinitiative.com/advisories/ZDI-CAN-21612 · Note