by Kastro
Paper/Archive/CVE-2023-23607

CVE-2023-23607

erohtar Dasherr — Unrestricted file upload leads to Remote Code Execution in erohtar/Dasherr

EPSS 2%public exploitCVSS 9.8
critical.is priorityof 100
55
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 77.0.770 × 2015.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

erohtar/Dasherr is a dashboard for self-hosted services. In affected versions unrestricted file upload allows any unauthenticated user to execute arbitrary code on the server. The file /www/include/filesave.php allows for any file to uploaded to anywhere. If an attacker uploads a php file they can execute code on the server. This issue has been addressed in version 1.05.00. Users are advised to upgrade. There are no known workarounds for this issue.

Affected

ProductAffectedFixed inSource
Dasherr< 1.05.00–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/erohtar/Dasherr/security/advisories/GHSA-6rgc-2x44-7phqrefgithub.com/erohtar/Dasherr/commit/445325c7cf1148a8cd38af3a90789c6cbf6c5112refvicarius.io/vsociety/posts/analyzing-arbitrary-file-upload-in-dasherr-cve-2023-23607-23608