Exploit

CVE-2023-2249

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') (CWE-98)

Published: Jun 9, 2023 / Updated: 17mo ago

Risk Vulnerability/Situation References Related Fingerprint Situation Type High Softing-Edgeaggregator-Restore-Configuration-Directory-Traversal CVE-2023-38126 File-Member-Name_Softing-Edgeaggregator-Restore-Configuration-Directory-Traversal Suspected Compromise Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description High Directory-Traversal No CVE/CAN HTTP_CSU-Dot-Dot-Slash-And-Null-Byte-Sequence Attack Related Anomalies Detection mechanism updated High Directory-Traversal No CVE/CAN HTTP_CSU-Potential-Dot-Dot-Slash-Directory-Traversal Potential Compromise Name: HTTP_CSU-Dot-Dot-Slash-Directory-Traversal->HTTP_CSU-Potential-Dot-Dot-Slash-Directory-Traversal Fingerprint regexp changed

The post CPAI-2023-0556 appeared first on Check Point Software .

We can see only 2 functions have been modified between the vulnerable and the patched versions of the file namely the ‘profiles_default_cover_upload’ and ‘profile_cover_upload’ which seem to be functionalities related to profile picture upload. From rough static code analysis, it seems like the user input for profile image data which is passed as ‘image_blob’ parameter if it doesn’t conform to a certain format, it gets passed to ‘file_get_contents’ as part of the else block.

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA.

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA.