PT-2024-13859 · Rengine · Rengine

N-Thumann · Published 2024-01-01 · Updated 2024-08-14 · CVE-2023-50094

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions reNgine versions prior to 2.1.2

Description The issue allows OS Command Injection if an adversary has a valid session ID. The attack involves placing shell metacharacters in an "api/tools/waf detector/?url=" string. The commands are executed as root via subprocess.check output().

Recommendations For versions prior to 2.1.2, update to version 2.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the "api/tools/waf detector/?url=" endpoint until a patch is available. Avoid using the url parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-50094

GHSA-FX7F-F735-VGH4

Affected Products

Rengine

References · 15

• 🔥 https://mattz.io/posts/cve-2023-50094 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-50094 · Security Note
• https://osv.dev/vulnerability/CVE-2023-50094 · Vendor Advisory
• https://github.com/yogeshojha/rengine/commit/edd3c85ee16f93804ad38dac5602549d2d30a93e · Note
• https://github.com/yogeshojha/rengine/security/advisories/GHSA-fx7f-f735-vgh4 · Note
• https://github.com/yogeshojha/rengine/security · Note
• https://github.com/yogeshojha/rengine/releases · Note
• https://github.com/yogeshojha/rengine/blob/53d9f505f04861a5040195ea71f20907ff90577a/web/api/views.py#L268-L275 · Note
• https://github.com/yogeshojha/rengine/blob/5e120bd5f9dfbd1da82a193e8c9702e483d38d22/web/api/views.py#L195 · Note
• https://github.com/yogeshojha/rengine/commit/3d5f1724dd12cf9861443742e7d7c02ff8c75a6f · Note
• https://twitter.com/VulmonFeeds/status/1741906367777005852 · Twitter Post
• https://t.me/cvenotify/90601 · Telegram Post
• https://t.me/cibsecurity/74095 · Telegram Post
• https://t.me/cvenotify/66821 · Telegram Post
• https://twitter.com/CVEnew/status/1741886803571781802 · Twitter Post