CVE-2023-23607 Unrestricted file upload leads to Remote Code Execution in erohtar/Dasherr
Unauthenticated attackers can upload arbitrary files to execute code on the server via an unrestricted file upload vulnerability in Dasherr.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-23607?
CVE-2023-23607 is a critical vulnerability in erohtar Dasherr, published on 20 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
erohtar/Dasherr is a dashboard for self-hosted services. In affected versions unrestricted file upload allows any unauthenticated user to execute arbitrary code on the server. The file /www/include/filesave.php allows for any file to uploaded to anywhere. If an attacker uploads a php file they can execute code on the server. This issue has been addressed in version 1.05.00. Users are advised to upgrade. There are no known workarounds for this issue.
Weakness: CWE-434
Which versions are affected by CVE-2023-23607?
It affects 1 product.
Products include Dasherr Project Dasherr.
How do I fix CVE-2023-23607?
No fix has been published for CVE-2023-23607 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-23607 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-23607 exists.
Sources
Also known as GHSA-6rgc-2x44-7phq.