CVE-2023-31465 Command injection in n/a
Attackers can execute arbitrary Bash commands on FSMLabs TimeKeeper servers by injecting code into URL query parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-31465?
CVE-2023-31465 is a critical command injection vulnerability in n/a, published on 26 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call. Some query parameters are passed directly in the URL and named arg[x], with x an integer starting from 1; it is possible to modify arg[2] to insert Bash code that will be executed directly by the server.
Which versions are affected by CVE-2023-31465?
It affects 1 product.
Products include Fsmlabs Timekeeper.
How do I fix CVE-2023-31465?
No fix has been published for CVE-2023-31465 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-31465 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-31465 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7xq6-44ph-rwqf.