PT-2023-7469 · Openssl · Openssl

Published 2023-11-23 · Updated 2024-08-02 · CVE-2023-49210

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions openssl (aka node-openssl) versions through 2.0.0

Description The issue is related to the absence of input data sanitization in the openssl package of the NPM package manager. This allows a remote attacker to execute arbitrary commands by exploiting the vulnerability. The vulnerability only affects products that are no longer supported by the maintainer. There are elevated activities targeting this issue.

Recommendations For versions through 2.0.0, consider disabling the verb field in the opts argument to prevent command execution until a fix is available. Restrict access to the opts argument to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-08512

CVE-2023-49210

GHSA-75W2-QV55-X7FV

Affected Products

Openssl

References · 12

• 🔥 https://gist.github.com/mcoimbra/b05a55a5760172dccaa0a827647ad63e · Exploit
• https://github.com/ossf/malicious-packages/tree/main/malicious/npm · Patch
• https://osv.dev/vulnerability/CVE-2023-49210 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49210 · Security Note
• https://bdu.fstec.ru/vul/2023-08512 · Security Note
• https://osv.dev/vulnerability/GHSA-75w2-qv55-x7fv · Vendor Advisory
• https://t.me/cvenotify/88661 · Telegram Post
• https://npmjs.com/package/openssl · Note
• https://t.me/cvenotify/61058 · Telegram Post
• https://twitter.com/vuldb/status/1797906652785701165 · Twitter Post
• https://security.snyk.io/vuln/SNYK-JS-OPENSSL-6084018 · Note
• https://vuldb.com/ru/?id.246092 · Note