PT-2023-7673 · Web2Py · Web2Py

Masashi Yamane · Published 2023-10-16 · Updated 2023-11-05 · CVE-2023-45158

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions web2py versions 2.24.1 and earlier

Description A command injection vulnerability exists in the product. When configured to use notifySendHandler for logging, a crafted web request may execute an arbitrary OS command on the web server. This issue arises due to the lack of neutralization of special elements.

Recommendations For versions 2.24.1 and earlier, consider disabling the notifySendHandler for logging until a patch is available to prevent potential exploitation. Restrict access to the web server to minimize the risk of arbitrary OS command execution. Avoid using the product with the vulnerable configuration to reduce the risk of command injection attacks.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-08740

CVE-2023-45158

Affected Products

Web2Py

References · 21

• 🔥 https://github.com/Evan-Zhangyf/CVE-2023-45158 · Exploit
• https://github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-45158 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/700193 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45158 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45158 · Security Note
• https://bdu.fstec.ru/vul/2023-08740 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-45158 · Security Note
• https://ubuntu.com/security/CVE-2023-45158 · Vendor Advisory
• https://twitter.com/Komodosec/status/1714450867028726211 · Twitter Post
• https://t.me/pentestingnews/40253 · Telegram Post
• http://web2py.com · Note
• https://twitter.com/the_yellow_fall/status/1714117118122488050 · Twitter Post
• https://twitter.com/fletch_ai/status/1714463063900889224 · Twitter Post
• https://vuldb.com/ru/?id.242222 · Note