CVE-2023-31465

CRITICALNuclei

FSMLabs TimeKeeper Code Execution

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2023-31465 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call. Some query parameters are passed directly in the URL and named arg[x], with x an integer starting from 1; it is possible to modify arg[2] to insert Bash code that will be executed directly by the server.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 4, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 23, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

timekeeper

Browse fsmlabs / timekeeper
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALTimeKeeper by FSMLabs - Remote Code ExecutionCVSS 9.8

An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call. Some query parameters are passed directly in the URL and named arg[x], with x an integer starting from 1; it is possible to modify arg[2] to insert Bash code that will be executed directly by the server.

Impact

Unauthenticated attackers can inject Bash commands through the arg[2] parameter in getsamplebacklog endpoint to execute arbitrary commands on the server, potentially compromising the entire TimeKeeper time synchronization infrastructure.

Remediation

Update FSMLabs TimeKeeper to a version newer than 8.0.28 that properly sanitizes input parameters in getsamplebacklog and prevents command injection attacks.

Authorsritikchaddha
Template tagscvecve2023timekeeperrceoastfsmlabsvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:fsmlabs:timekeeper:*:*:*:*:*:*:*:*
Shodan: http.favicon.hash:2134367771
FOFA: icon_hash=2134367771
https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-ID%20%7C%20RealGimm%20%20-%20Reflected%20Cross-site%20Scripting.md https://nvd.nist.gov/vuln/detail/CVE-2023-31465 https://fsmlabs.com/fsmlabs-cybersecurity/

Source: ProjectDiscovery

References

3