CVE-2023-0093 Command injection in Advanced Server Access
Attackers can execute arbitrary commands by phishing users into entering malicious URLs during enrollment in the Okta Advanced Server Access Client.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-0093?
CVE-2023-0093 is a high-severity command injection vulnerability in Okta Advanced Server Access, published on 6 Mar 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment.
Weakness: CWE-77
Which versions are affected by CVE-2023-0093?
It affects 1 product.
Products include Okta Advanced Server Access.
How do I fix CVE-2023-0093?
No fix has been published for CVE-2023-0093 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-0093 being exploited?
There is no known exploitation of CVE-2023-0093 in the wild and no public exploit code.
Other vulnerabilities in Okta Advanced Server Access
Sources
Also known as GHSA-vm8m-8vm4-x33v.