CVE-2023-28627 OS Command Injection via GIT_PATH in pymedusa
An attacker with web interface access can inject arbitrary OS commands via the git path setting, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-28627?
CVE-2023-28627 is a high-severity command injection vulnerability in pymedusa Medusa, published on 27 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pymedusa is an automatic video library manager for TV Shows. In versions prior 1.0.12 an attacker with access to the web interface can update the git executable path in /config/general/ > advanced settings with arbitrary OS commands. An attacker may exploit this vulnerability to take execute arbitrary OS commands as the user running the pymedusa program. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-78
Which versions are affected by CVE-2023-28627?
It affects 1 product.
Products include Pymedusa Medusa.
How do I fix CVE-2023-28627?
No fix has been published for CVE-2023-28627 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-28627 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-28627 exists.
Other vulnerabilities in pymedusa Medusa
Sources
Also known as GHSA-6589-x6f5-cgg9.