CVE-2024-23793 Upload of files outside application directory
Authenticated users can exploit a path traversal flaw in the file upload feature to write files outside the application directory, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-23793?
CVE-2024-23793 is a medium-severity path traversal vulnerability in ((OTRS)) Community Edition, published on 6 Jun 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The file upload feature in OTRS and ((OTRS)) Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl scripts. This issue affects OTRS: from 7.0.X through 7.0.49, 8.0.X, 2023.X, from 2024.X through 2024.3.2; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
Weakness: CWE-22
Which versions are affected by CVE-2024-23793?
How do I fix CVE-2024-23793?
No fix has been published for CVE-2024-23793 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-23793 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-23793 exists.
Sources
Also known as GHSA-cqhr-chmp-4x86, UBUNTU-CVE-2024-23793.