PT-2023-6726 · Unknown · Webui-Aria2

Jafarakhondali · Published 2023-08-22 · Updated 2024-10-14 · CVE-2023-39141

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions webui-aria2 version 4fe2e

Description The issue is related to a path traversal vulnerability in the WebUI-Aria2 interface. This vulnerability is due to incorrect restriction of the directory path name with limited access. Exploitation of this issue may allow a remote attacker to disclose protected information.

Recommendations For version 4fe2e, consider restricting access to sensitive directories to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Path traversal

Weakness Enumeration

CWE-400

CWE-22

Related Identifiers

BDU:2023-07502

CVE-2023-39141

GHSA-CRV8-R5WQ-GV2W

Affected Products

Webui-Aria2

References · 10

• 🔥 https://gist.github.com/JafarAkhondali/528fe6c548b78f454911fb866b23f66e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-39141 · Security Note
• https://bdu.fstec.ru/vul/2023-07502 · Security Note
• https://osv.dev/vulnerability/GHSA-crv8-r5wq-gv2w · Vendor Advisory
• https://github.com/ziahamza/webui-aria2/blob/109903f0e2774cf948698cd95a01f77f33d7dd2c/node-server.js#L10 · Note
• https://github.com/ziahamza/webui-aria2 · Note
• https://t.me/cybersecuritytechnologies/8944 · Telegram Post
• https://t.me/cibsecurity/68965 · Telegram Post
• https://twitter.com/kr3ypt0n/status/1801323061742080294 · Twitter Post
• https://twitter.com/DjalilAyed/status/1845833679265828967 · Twitter Post