CVE-2023-45869

ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec() function in the execQuoted() method of the ilUtil class (/Services/Utilities/classes/class.ilUtil.php) This allows attackers to inject malicious commands into the system, potentially compromising the integrity, confidentiality, and availability of the ILIAS installation and the underlying operating system.

CVSS v3 9.0 CRITICAL

9.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://rehmeinfosec.de/labor/cve-2023-45869	Exploit Third Party Advisory
https://rehmeinfosec.de/report/358ad5f6-f712-4f74-a5ee-476efc856cbc/	Third Party Advisory
https://rehmeinfosec.de/labor/cve-2023-45869	Exploit Third Party Advisory
https://rehmeinfosec.de/report/358ad5f6-f712-4f74-a5ee-476efc856cbc/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ilias:ilias:7.25:*:*:*:*:*:*:*

History

21 Nov 2024, 08:27

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-26 15:15

Updated : 2024-11-21 08:27

NVD link : CVE-2023-45869

Mitre link : CVE-2023-45869

CVE.ORG link : CVE-2023-45869

JSON object : View

Products Affected

ilias

ilias

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2023-45869", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "published": "2023-10-26T15:15:09.010", "references": [{"url": "https://rehmeinfosec.de/labor/cve-2023-45869", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://rehmeinfosec.de/report/358ad5f6-f712-4f74-a5ee-476efc856cbc/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://rehmeinfosec.de/labor/cve-2023-45869", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://rehmeinfosec.de/report/358ad5f6-f712-4f74-a5ee-476efc856cbc/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec() function in the execQuoted() method of the ilUtil class (/Services/Utilities/classes/class.ilUtil.php) This allows attackers to inject malicious commands into the system, potentially compromising the integrity, confidentiality, and availability of the ILIAS installation and the underlying operating system."}, {"lang": "es", "value": "ILIAS 7.25 (2023-09-12) permite a cualquier usuario autenticado ejecutar comandos arbitrarios del sistema operativo de forma remota, cuando una cuenta con altos privilegios accede a un payload XSS. Los comandos inyectados se ejecutan a trav\u00e9s de la funci\u00f3n exec() en el m\u00e9todo execQuoted() de la clase ilUtil (/Services/Utilities/classes/class.ilUtil.php). Esto permite a los atacantes inyectar comandos maliciosos en el sistema, comprometiendo potencialmente la integridad, confidencialidad y disponibilidad de la instalaci\u00f3n de ILIAS y del sistema operativo subyacente."}], "lastModified": "2024-11-21T08:27:31.547", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ilias:ilias:7.25:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF8E6CB0-A19A-4B18-90D8-352676E169E9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}