CVE-2023-28725

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-28725
General Bytes Crypto Application Server (CAS) 20230120, as distributed with General Bytes BATM devices, allows remote attackers to execute arbitrary Java code by uploading a Java application to the /batm/app/admin/standalone/deployments directory, aka BATM-4780, as exploited in the wild in March 2023. This is fixed in 20221118.48 and 20230120.44.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://arstechnica.com/information-technology/2023/03/hackers-drain-bitcoin-atms-of-1-5-million-by-exploiting-0-day-bug/ Press/Media Coverage
https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/2885222430/Security+Incident+March+17-18th+2023 Exploit Vendor Advisory
https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/951418958/Update+CAS Mitigation
https://twitter.com/generalbytes/status/1637192687160897537 Issue Tracking
https://web3isgoinggreat.com/single/general-bytes-crypto-atms-exploited-for-over-1-6-million Third Party Advisory
https://www.bleepingcomputer.com/news/security/general-bytes-bitcoin-atms-hacked-using-zero-day-15m-stolen/ Press/Media Coverage
https://www.generalbytes.com/en/support/changelog Release Notes
https://arstechnica.com/information-technology/2023/03/hackers-drain-bitcoin-atms-of-1-5-million-by-exploiting-0-day-bug/ Press/Media Coverage
https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/2885222430/Security+Incident+March+17-18th+2023 Exploit Vendor Advisory
https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/951418958/Update+CAS Mitigation
https://twitter.com/generalbytes/status/1637192687160897537 Issue Tracking
https://web3isgoinggreat.com/single/general-bytes-crypto-atms-exploited-for-over-1-6-million Third Party Advisory
https://www.bleepingcomputer.com/news/security/general-bytes-bitcoin-atms-hacked-using-zero-day-15m-stolen/ Press/Media Coverage
https://www.generalbytes.com/en/support/changelog Release Notes
Configurations

Configuration 1 (hide)

cpe:2.3:a:generalbytes:crypto_application_server:20230120:*:*:*:*:*:*:*
History

21 Nov 2024, 07:55

Type Values Removed Values Added
References () https://arstechnica.com/information-technology/2023/03/hackers-drain-bitcoin-atms-of-1-5-million-by-exploiting-0-day-bug/ - Press/Media Coverage () https://arstechnica.com/information-technology/2023/03/hackers-drain-bitcoin-atms-of-1-5-million-by-exploiting-0-day-bug/ - Press/Media Coverage
References () https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/2885222430/Security+Incident+March+17-18th+2023 - Exploit, Vendor Advisory () https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/2885222430/Security+Incident+March+17-18th+2023 - Exploit, Vendor Advisory
References () https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/951418958/Update+CAS - Mitigation () https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/951418958/Update+CAS - Mitigation
References () https://twitter.com/generalbytes/status/1637192687160897537 - Issue Tracking () https://twitter.com/generalbytes/status/1637192687160897537 - Issue Tracking
References () https://web3isgoinggreat.com/single/general-bytes-crypto-atms-exploited-for-over-1-6-million - Third Party Advisory () https://web3isgoinggreat.com/single/general-bytes-crypto-atms-exploited-for-over-1-6-million - Third Party Advisory
References () https://www.bleepingcomputer.com/news/security/general-bytes-bitcoin-atms-hacked-using-zero-day-15m-stolen/ - Press/Media Coverage () https://www.bleepingcomputer.com/news/security/general-bytes-bitcoin-atms-hacked-using-zero-day-15m-stolen/ - Press/Media Coverage
References () https://www.generalbytes.com/en/support/changelog - Release Notes () https://www.generalbytes.com/en/support/changelog - Release Notes

27 Mar 2023, 22:19

Type Values Removed Values Added
CPE cpe:2.3:a:generalbytes:crypto_application_server:20230120:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.1
CWE CWE-434
References (MISC) https://www.generalbytes.com/en/support/changelog - (MISC) https://www.generalbytes.com/en/support/changelog - Release Notes
References (MISC) https://web3isgoinggreat.com/single/general-bytes-crypto-atms-exploited-for-over-1-6-million - (MISC) https://web3isgoinggreat.com/single/general-bytes-crypto-atms-exploited-for-over-1-6-million - Third Party Advisory
References (MISC) https://www.bleepingcomputer.com/news/security/general-bytes-bitcoin-atms-hacked-using-zero-day-15m-stolen/ - (MISC) https://www.bleepingcomputer.com/news/security/general-bytes-bitcoin-atms-hacked-using-zero-day-15m-stolen/ - Press/Media Coverage
References (MISC) https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/951418958/Update+CAS - (MISC) https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/951418958/Update+CAS - Mitigation
References (MISC) https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/2885222430/Security+Incident+March+17-18th+2023 - (MISC) https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/2885222430/Security+Incident+March+17-18th+2023 - Exploit, Vendor Advisory
References (MISC) https://twitter.com/generalbytes/status/1637192687160897537 - (MISC) https://twitter.com/generalbytes/status/1637192687160897537 - Issue Tracking
References (MISC) https://arstechnica.com/information-technology/2023/03/hackers-drain-bitcoin-atms-of-1-5-million-by-exploiting-0-day-bug/ - (MISC) https://arstechnica.com/information-technology/2023/03/hackers-drain-bitcoin-atms-of-1-5-million-by-exploiting-0-day-bug/ - Press/Media Coverage

22 Mar 2023, 00:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-03-22 00:15

Updated : 2025-02-26 17:15

NVD link : CVE-2023-28725

Mitre link : CVE-2023-28725

CVE.ORG link : CVE-2023-28725

JSON object : View

Products Affected

generalbytes

  • crypto_application_server
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type