CVE-2023-2479

CRITICALNuclei

OS Command Injection in appium/appium-desktop

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-2479 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 30, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

appium/appium-desktop

Browse appium / appium/appium-desktop
CVE ListBefore v1.22.3-4affected

appium-desktop

Browse npm / appium-desktop
GitHub AdvisoryThrough 1.14.1affected

Nuclei templates

1
ProjectDiscoveryCRITICALAppium Desktop Server - Remote Code ExecutionCVSS 9.8

OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.

Impact

Unauthenticated attackers can exploit OS command injection through the url parameter to execute arbitrary system commands and completely compromise Appium Desktop Server installations.

Remediation

Fixed in v1.22.3-4

WeaknessesCWE-78
Authorszn9988
Template tagscve2023cvehuntrappiumoastrcevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:appium:appium-desktop:*:*:*:*:*:*:*:*
https://nvd.nist.gov/vuln/detail/CVE-2023-2479 https://huntr.dev/bounties/fbdeec3c-d197-4a68-a547-7f93fb9594b4/ https://github.com/appium/appium-desktop/commit/12a988aa08b9822e97056a09486c9bebb3aad8fe https://github.com/Marco-zcl/POC https://github.com/d4n-sec/d4n-sec.github.io

Source: ProjectDiscovery

References

4