CVE-2023-22855
CRITICALKardex Mlog MCC 5.7.12+0-a203c2a213-master - Remote Code Execution via Path Traversal and T4 Template Injection
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2023-22855. PoCs published by Patrick Hener, vianic.
AI-analyzed exploit summary This exploit leverages a file inclusion vulnerability in Kardex Mlog MCC to achieve remote code execution by serving a malicious T4 template via an SMB server, which triggers a PowerShell reverse shell.
Description
Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 8088. A user-controllable path is handed to a path-concatenation method (Path.Combine from .NET) without proper sanitisation. This yields the possibility of including local files, as well as remote files on SMB shares. If one provides a file with the extension .t4, it is rendered with the .NET templating engine mono/t4, which can execute code.
Exploits (2)
This exploit leverages a file inclusion vulnerability in Kardex Mlog MCC to achieve remote code execution by serving a malicious T4 template via an SMB server, which triggers a PowerShell reverse shell.
This repository provides a detailed technical analysis of CVE-2023-22855, a Remote File Inclusion (RFI) vulnerability in Kardex Mlog MCC software. It includes a proof-of-concept exploit demonstrating how improper path sanitization leads to remote code execution via the .NET `Path.Combine` function and T4 templating engine.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H