CVE-2023-6319 Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service
Authenticated attackers can execute arbitrary commands as root via crafted requests to the attached storage manager service in LG webOS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-6319?
CVE-2023-6319 is a critical command injection vulnerability in LG webOS, published on 9 Apr 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability.
* webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA
* webOS 5.5.0 - 04.50.51 running on OLED55CXPUA
* webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB
* webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA
Weakness: CWE-78
Which versions are affected by CVE-2023-6319?
It affects 1 product.
Products include Lg Webos.
How do I fix CVE-2023-6319?
No fix has been published for CVE-2023-6319 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-6319 being exploited?
There is no known exploitation of CVE-2023-6319 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in LG webOS
- CVE-2022-23730 Auth bypass in LG webOS TV
- CVE-2023-6318 Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service
- CVE-2023-6320 Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint
- CVE-2022-23731 Privilege escalation in LG webOS TV
- CVE-2022-23727 Privilege escalation in n/a
Sources
Also known as GHSA-rgwx-4v25-2mj5.