CVE-2023-47039 Perl: perl for windows binary hijacking vulnerability
An attacker can execute arbitrary code with administrator privileges by placing a malicious cmd.exe in the current working directory due to insecure path search order.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-47039?
CVE-2023-47039 is a high-severity path traversal vulnerability in Red Hat Enterprise Linux 6, published on 2 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find and execute `cmd.exe` within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. This flaw allows an attacker with limited privileges to place`cmd.exe` in locations with weak permissions, such as `C:\ProgramData`. By doing so, arbitrary code can be executed when an administrator attempts to use this executable from these compromised locations.
Which versions are affected by CVE-2023-47039?
It affects 1 product.
Products include Perl Perl.
How do I fix CVE-2023-47039?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-47039 being exploited?
There is no known exploitation of CVE-2023-47039 in the wild and no public exploit code.
Other vulnerabilities in Red Hat Enterprise Linux 6
Sources
Also known as GHSA-44qm-928x-6p3g, UBUNTU-CVE-2023-47039.