PT-2023-5024 · Alteryx · Alteryx Server

Dylangrl · Published 2023-08-08 · Updated 2023-08-21 · CVE-2023-26961

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Alteryx Server version 2022.1.1.42590

Description The issue exists due to the lack of protection for the web page structure in Alteryx Server, allowing remote attackers to perform cross-site scripting (XSS) attacks via the type field using a PUT request to the "/gallery/api/media" endpoint. This vulnerability also enables attackers to upload arbitrary files, such as JavaScript content for stored XSS, by changing the file extension.

Recommendations For Alteryx Server version 2022.1.1.42590, consider disabling the ability to upload files via the "/gallery/api/media" endpoint until a patch is available. Restrict access to the type field in the JSON document within the PUT request to minimize the risk of exploitation. As a temporary workaround, implement file type verification for uploaded files to prevent attackers from uploading arbitrary files.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-20

CWE-79

Related Identifiers

BDU:2023-05563

CVE-2023-26961

Affected Products

Alteryx Server

References · 12

• 🔥 https://gist.github.com/DylanGrl/4269ae834c5d0ec77c9b928ad35d3be3 · Exploit
• https://osv.dev/vulnerability/CVE-2023-26961 · Vendor Advisory
• http://alteryx.com · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05563 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-26961 · Security Note
• https://twitter.com/CVEnew/status/1689711688533327872 · Twitter Post
• https://twitter.com/CVEnew/status/1689919284578025472 · Twitter Post
• https://twitter.com/CVEnew/status/1689198262509580288 · Twitter Post
• https://twitter.com/CVEnew/status/1689938002326249472 · Twitter Post
• https://t.me/cibsecurity/68064 · Telegram Post
• https://t.me/cvenotify/56404 · Telegram Post
• https://twitter.com/CVEnew/status/1689749371871440896 · Twitter Post