CVE-2023-38316 Command injection in n/a

Critical 9.8 Published 17 Nov 2023 Updated 4 Sep 2024

Attackers can execute arbitrary OS commands via HTTP GET requests when the custom unescape callback is enabled in OpenNDS Captive Portal.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-38316?

CVE-2023-38316 is a critical command injection vulnerability in n/a, published on 17 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS commands by inserting them into the URL portion of HTTP GET requests. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3.

Weakness: CWE-116

Which versions are affected by CVE-2023-38316?

It affects 1 product.

Products include Opennds Captive Portal.

How do I fix CVE-2023-38316?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-38316 being exploited?

There is no known exploitation of CVE-2023-38316 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2023-38316, GHSA-857f-w8mj-5g2g.