CVE-2023-34102 Possible unsafe reflection / partial denial of service in avo
Attackers can achieve remote code execution or cause application crashes in the Avo admin panel by manipulating polymorphic field inputs without backend validation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-34102?
CVE-2023-34102 is a high-severity code injection vulnerability in avo-hq avo, published on 5 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. This issue has been addressed in commit `ec117882d` which is expected to be included in subsequent releases. Users are advised to limit access to untrusted users until a new release is made.
Which versions are affected by CVE-2023-34102?
4 open source packages ship an affected version, including avo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
avo RubyGems | All versions | 2.33.3 |
avo RubyGems | All versions | 2.33.3 |
avo RubyGems | From 3.0.0.pre1 to 3.0.0.pre12 | None |
avo RubyGems | From 3.0.0.pre1 to 3.0.0.pre12 | None |
Products include Avohq Avo.
How do I fix CVE-2023-34102?
Upgrade avo to 2.33.3 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-34102 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-34102 exists.
Other vulnerabilities in avo-hq avo
Sources
Also known as GHSA-86h2-2g4g-29qx.