PT-2023-8825 · Kiwi Tcms · Kiwi Tcms

Mnqazi + 1 · Published 2023-07-05 · Updated 2023-08-13 · CVE-2023-36809

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 12.5

Description The issue is related to the upload of attachments to test plans and test cases in Kiwi TCMS. Earlier versions of Kiwi TCMS had changes to serve all uploaded files as plain text to prevent browsers from executing potentially dangerous files. However, the previous Nginx configuration was incorrect, allowing certain browsers like Firefox to ignore the Content-Type: text/plain header on some occasions, thus allowing potentially dangerous scripts to be executed. Additionally, file upload validators and parts of the HTML rendering code required additional sanitation and improvements. The tree view html() function also needed sanitization of test plan names.

Recommendations For versions prior to 12.5, update to version 12.5, which includes an updated Nginx content type configuration, improved file upload validation code, and sanitization of test plan names used in the tree view html() function. As a temporary workaround, consider restricting file uploads and access to potentially dangerous files until the update is applied.

Exploit

Fix

Unrestricted File Upload

XSS

Weakness Enumeration

CWE-434

CWE-79

Related Identifiers

BDU:2024-02095

CVE-2023-36809

GHSA-JPGW-2R9M-8QFW

Affected Products

Kiwi Tcms

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36809.json · Exploit
• 🔥 https://huntr.dev/bounties/c6eeb346-fa99-4d41-bc40-b68f8d689223 · Exploit
• 🔥 https://huntr.dev/bounties/511489dd-ba38-4806-9029-b28ab2830aa8 · Exploit
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-jpgw-2r9m-8qfw · Vendor Advisory
• https://github.com/kiwitcms/kiwi/commit/ffb00450be52fe11a82a2507632c2328cae4ec9d · Patch
• https://github.com/kiwitcms/kiwi/commit/195ea53eaaf360c19227c864cc0fe58910032c3c · Patch
• https://bdu.fstec.ru/vul/2024-02095 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-36809 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36809 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jpgw-2r9m-8qfw · Vendor Advisory
• https://github.com/kiwitcms/Kiwi · Note
• https://kiwitcms.org/blog/kiwi-tcms-team/2023/07/04/kiwi-tcms-125 · Note
• https://twitter.com/mq_xz_/status/1690660745648930816 · Twitter Post
• https://t.me/cvenotify/53700 · Telegram Post