PT-2023-8827 · Kiwi Tcms+1 · Kiwi Tcms+1

Mnqazi · Published 2023-06-06 · Updated 2023-06-14 · CVE-2023-33977

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 12.4

Description The issue is related to the lack of protection of the web page structure in Kiwi TCMS, allowing a remote attacker to upload arbitrary attachments to test plans and test cases. Earlier versions of Kiwi TCMS had introduced upload validators and Content-Security-Policy definitions to prevent cross-site-scripting attacks, but the upload validation checks were not robust, leaving the possibility to circumvent them and upload potentially dangerous files. This allows the execution of arbitrary JavaScript in the browser. Additionally, Nginx's proxy pass directive can strip some headers, negating protections built into Kiwi TCMS when served behind a reverse proxy.

Recommendations For versions prior to 12.4, upgrade to version 12.4 or later to address the issue. For users unable to upgrade who are serving Kiwi TCMS behind a reverse proxy, make sure that additional header values are still passed to the client browser. If they aren't, redefine them inside the proxy configuration. As a temporary workaround, consider improving file upload validation code and updating Nginx reverse proxy configuration to prevent exploitation.

Exploit

Fix

Unrestricted File Upload

XSS

Weakness Enumeration

CWE-434

CWE-79

Related Identifiers

BDU:2024-02097

CVE-2023-33977

GHSA-2FQM-M4R2-FH98

Affected Products

Kiwi Tcms

Nginx

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33977.json · Exploit
• 🔥 https://huntr.dev/bounties/6aea9a26-e29a-467b-aa5a-f767f0c2ec96 · Exploit
• https://github.com/kiwitcms/Kiwi/commit/d789f4b51025de4f8c747c037d02e1b0da80b034 · Patch
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2fqm-m4r2-fh98 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33977 · Security Note
• https://osv.dev/vulnerability/GHSA-2fqm-m4r2-fh98 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-33977 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02097 · Security Note
• https://github.com/kiwitcms/kiwi/commit/d789f4b51025de4f8c747c037d02e1b0da80b034 · Note
• https://github.com/kiwitcms/Kiwi · Note
• https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L87 · Note
• https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L66-L68 · Note
• https://kiwitcms.org/blog/kiwi-tcms-team/2023/06/06/kiwi-tcms-124 · Note