CVE-2023-50254 Deepin Reader RCE vulnerability due to a design flaw
Attackers can achieve remote code execution by tricking users into opening a crafted docx file that overwrites shell configuration files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-50254?
CVE-2023-50254 is a critical path traversal vulnerability in linuxdeepin developer-center, published on 22 Dec 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Deepin Linux's default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads to remote command execution via crafted docx document. This is a file overwrite vulnerability. Remote code execution (RCE) can be achieved by overwriting files like .bash_rc, .bash_login, etc. RCE will be triggered when the user opens the terminal. Version 6.0.7 contains a patch for the issue.
Which versions are affected by CVE-2023-50254?
It affects 1 product.
Linux distribution packages (1)
deepin-reader openSUSE:Tumbleweed | All versions | 5.10.23-2.1 |
Products include Deepin Deepin Reader.
How do I fix CVE-2023-50254?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-50254 being exploited?
There is no known exploitation of CVE-2023-50254 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-q9jr-726g-9495, openSUSE-SU-2024:13536-1.