CVE-2023-0265: Uvdesk 1.1.1 - RCE via Insecure File Upload | Advisories | Fluid Attacks

3. Supply

Summary

Name

Uvdesk 1.1.1 - RCE via Insecure File Upload

Code name

Supply

Product

Uvdesk

Affected versions

Version 1.1.1

State

Public

Release date

2023-04-10

Vulnerability

Kind

Insecure file upload

Rule

027. Insecure file upload

Remote

Yes

CVSSv3 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSSv3 Base Score

9.9

Exploit available

Yes

CVE ID(s)

CVE-2023-0265

Description

Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers.

Vulnerability

This vulnerability occurs because the application does not properly validate profile pictures uploaded by customers.

Exploitation

The application only accepts images (validates content and mimetype), however it does not correctly validate the image extension. Thanks to this we can inject PHP code in the image comments (so as not to corrupt it), and then through a proxy we change the image extension to .php.

Evidence of exploitation****Our security policy

We have reserved the CVE-2023-0265 to refer to this issue from now on.

• https://fluidattacks.com/advisories/policy/

System Information

• Version: Uvdesk 1.1.1

• Operating System: GNU/Linux

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Carlos Bello from Fluid Attacks’ Offensive Team.

References

Vendor page https://github.com/uvdesk/community-skeleton

Timeline

2023-12-14

Vulnerability discovered.

2023-12-14

Vendor contacted.

2023-12-14

Vendor replied acknowledging the report.

2023-04-10

Public Disclosure.