CVE-2020-11467 Deserialization in n/a
Attackers can achieve remote code execution in Deskpro by abusing Twig template variables to trigger unsafe deserialization via POP gadgets.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-11467?
CVE-2020-11467 is a critical unsafe deserialization vulnerability in n/a, published on 1 Apr 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue was discovered in Deskpro before 2019.8.0. This product enables administrators to modify the helpdesk interface by editing /portal/api/style/edit-theme-set/template-sources theme templates, and uses TWIG as its template engine. While direct access to self and _self variables was not permitted, one could abuse the accessible variables in one's context to reach a native unserialize function via the code parameter. There, on could pass a crafted payload to trigger a set of POP gadgets in order to achieve remote code execution.
Weakness: CWE-502
Which versions are affected by CVE-2020-11467?
It affects 1 product.
Products include Deskpro Deskpro.
How do I fix CVE-2020-11467?
No fix has been published for CVE-2020-11467 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-11467 being exploited?
There is no known exploitation of CVE-2020-11467 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-mhpq-2ph4-jm64.