CVE-2023-3452 Canto <= 3.0.4 - Unauthenticated Remote File Inclusion

What is CVE-2023-3452?

CVE-2023-3452 is a critical code injection vulnerability in flightbycanto Canto, published on 12 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.

Weakness: CWE-98

Which versions are affected by CVE-2023-3452?

It affects 1 product.

Products include Canto Canto.

How do I fix CVE-2023-3452?

No fix has been published for CVE-2023-3452 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-3452 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-3452 exists.

Public exploit code: 1 Nuclei template and 3 proofs of concept on GitHub.

Other vulnerabilities in flightbycanto Canto

• CVE-2024-25096 WordPress canto plugin <= 3.0.7 - Unauth. Remote Code Execution (RCE) vulnerability Critical 10.0
• CVE-2024-4936 Canto <= 3.0.8 - Unauthenticated Remote File Inclusion Critical 9.8
• CVE-2022-40305 Server-side request forgery in n/a Critical 9.8
• CVE-2020-24063 Server-side request forgery in n/a High 7.2
• CVE-2020-28976 Server-side request forgery in n/a Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r7j9-2qv5-fpm9.