CVE-2023-42033 Visualware MyConnection Server doPostUploadfiles Directory Traversal Remote Code Execution Vulnerability
Remote attackers can execute arbitrary code as root via directory traversal in the upload handler, bypassing authentication.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-42033?
CVE-2023-42033 is a high-severity path traversal vulnerability in Visualware MyConnection Server, published on 3 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Visualware MyConnection Server doPostUploadfiles Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Visualware MyConnection Server. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
The specific flaw exists within the doPostUploadfiles method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21612.
Weakness: CWE-22
Which versions are affected by CVE-2023-42033?
It affects 1 product.
Products include Visualware Myconnection Server.
How do I fix CVE-2023-42033?
No fix has been published for CVE-2023-42033 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-42033 being exploited?
There is no known exploitation of CVE-2023-42033 in the wild and no public exploit code.
Other vulnerabilities in Visualware MyConnection Server
- CVE-2021-27198 File upload in n/a
- CVE-2023-42034 Visualware MyConnection Server doRTAAccessCTConfig Cross-Site Scripting Authentication Bypass Vulnerability
- CVE-2023-42032 Visualware MyConnection Server doRTAAccessUPass Exposed Dangerous Method Information Disclosure Vulnerability
- CVE-2021-27509 Missing authorization in n/a
- CVE-2023-42035 Visualware MyConnection Server doIForward XML External Entity Processing Information Disclosure Vulnerability
Sources
Also known as GHSA-vcp3-4359-23x2.