CVE-2023-40050 Automate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application

Critical 9.9 Published 31 Oct 2023 Updated 6 Sep 2024

Attackers can achieve remote code execution by uploading malicious InSpec profiles via the API or interface in Chef Automate.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-40050?

CVE-2023-40050 is a critical vulnerability in Progress Software Corporation Chef Automate, published on 31 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution.

Weakness: CWE-94, CWE-434

Which versions are affected by CVE-2023-40050?

It affects 1 product.

Products include Chef Automate.

How do I fix CVE-2023-40050?

No fix has been published for CVE-2023-40050 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-40050 being exploited?

There is no known exploitation of CVE-2023-40050 in the wild and no public exploit code.

Sources

Also known as GHSA-7fj6-6m8r-4v8h.