PT-2023-6470 · Unknown · I-Doit Pro+1

Published 2023-09-10 · Updated 2023-09-20 · CVE-2023-37756

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions I-doit pro versions 25 and below I-doit open versions 25 and below

Description The issue is related to weak password requirements for Administrator account creation in the affected software. This weakness allows attackers to easily guess users' passwords via a bruteforce attack. Additionally, the vulnerability may enable a remote attacker to execute arbitrary code by uploading a malicious plugin.

Recommendations For I-doit pro versions 25 and below: Update the password requirements for Administrator account creation to prevent easy guessing via bruteforce attacks. For I-doit open versions 25 and below: Update the password requirements for Administrator account creation to prevent easy guessing via bruteforce attacks. As a temporary workaround, consider restricting access to the admin-center component to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-521

Related Identifiers

BDU:2023-07194

CVE-2023-37756

Affected Products

I-Doit Open

I-Doit Pro

References · 12

• 🔥 https://github.com/leekenghwa/CVE-2023-37756-CWE-521-lead-to-malicious-plugin-upload-in-the-i-doit-Pro-25-and-below/blob/main/README.md · Exploit
• 🔥 https://medium.com/@ray.999/idoit-pro-v25-and-below-weak-password-add-on-upload-to-rce-cve-2023-37756-fa1b18433ca3 · Exploit
• https://bdu.fstec.ru/vul/2023-07194 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37756 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37756 · Security Note
• https://i-doit.com/en/i-doit · Note
• https://t.me/cibsecurity/70573 · Telegram Post
• https://medium.com/%40ray.999/idoit-pro-v25-and-below-weak-password-add-on-upload-to-rce-cve-2023-37756-fa1b18433ca3 · Note
• https://twitter.com/VulmonFeeds/status/1700780585461879086 · Twitter Post
• https://twitter.com/ksg93rd/status/1701201188702609761 · Twitter Post
• https://t.me/cybersecuritytechnologies/9005 · Telegram Post
• https://twitter.com/CVEnew/status/1702419220808811001 · Twitter Post