CVE-2023-34446

HIGH

iTop XSS vulnerability on pages/preferences.php

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-34446 has a selected CVSS score of 8.8 (high); EIP currently links 1 repository PoC and 1 lab environment.

Description

iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, when displaying `pages/preferences.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 10, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

iTop

Browse Combodo / iTop

Default status: unknown

CVE List< 3.0.4affected
Before 3.0.4affected

Proofs of concept

1

Repository PoCs

GitHubminsmiths/cve-2023-34446Repository PoCby minsmiths0Exploit12 files

1.1 MiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a PoC exploit for CVE-2023-36664, a Ghostscript command injection vulnerability. It includes a Python script (poc.py) that generates a malicious PostScript file containing a %pipe% payload, and a Dockerfile to set up a vulnerable Ghostscript 10.01.1 environment. The README provides step-by-step instructions to build the container, generate the payload, and execute it with Ghostscript to achieve arbitrary command execution (e.g., opening a sensitive file with gedit).

Backdoor review

No backdoor observed in reviewed code

The repository contains a PoC for CVE-2023-36664 (Ghostscript RCE) and a Dockerfile. The PoC script (poc.py) generates a PostScript file with a user-supplied command embedded in a %pipe% payload, which is the documented exploit mechanism. The Dockerfile builds a vulnerable Ghostscript version and creates a test user. No concealed backdoor, unrelated remote access, persistence, or deceptive payload targeting the person running the PoC was observed. The README describes the exploit and its mechanism in detail.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPythonDockerfileMarkdown
Target softwareGhostscript
Attack typescommand injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains functional code (poc.py) that generates a malicious file designed to exploit CVE-2023-36664, and a Dockerfile to create a vulnerable environment. The README provides explicit instructions to execute the generated payload with Ghostscript to achieve command execution, which is the definition of an exploit.

poc.py:1-76README.md:200-213

Requirements

  • A vulnerable version of Ghostscript (prior to 10.01.2) must be installed.README.md:6
  • The attacker must be able to deliver a malicious PostScript file to the target and have it processed by Ghostscript.README.md:13

Observed behavior

  • The poc.py script generates a PostScript (.ps) or Encapsulated PostScript (.eps) file containing a %pipe% directive with a user-supplied command.poc.py:62
  • When the generated file is processed by a vulnerable Ghostscript instance, the embedded command is executed on the underlying operating system.README.md:85
  • The README demonstrates the exploit by opening a sensitive configuration file (/var/www/html/config.php) with gedit, revealing its contents.README.md:200README.md:217-221
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Payload Generation
Payload withheldThis is the documented CVE-2023-36664 exploit mechanism; the script does not execute the payload itself.poc.py:62
Vulnerable Software Installation
Payload withheldThe Dockerfile sets up the vulnerable environment for the PoC; no hidden backdoor commands are present.Dockerfile:13-14
Test Credential Creation
Payload withheldThis is a simulated sensitive file for the PoC demonstration, not a real credential leak.Dockerfile:22-23
Review boundaries

What the analysis did not establish

  • The evidence includes 8 non-text media files (images) that were not analyzed; their content may provide additional context but is not required for classification.
  • The artifact is associated with CVE-2023-34446 in metadata, but the actual content exclusively discusses CVE-2023-36664, indicating a possible metadata mismatch.
  • 8 non-text media files (PNG images) were present but not analyzed; they are referenced in README.md as screenshots and are unlikely to contain executable backdoor code.
  • 1 unclassified file (270 bytes) was not analyzed; its content is unknown but small size limits risk.
  • The review is limited to the supplied text evidence; no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

minsmiths/cve-2023-34446Created Vuln labCVE-2023-34446Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single-service Docker Compose environment that builds an Ubuntu 22.04 container with a vulnerable Ghostscript 10.01.1 installation, a Python PoC generator, and a simulated sensitive file, intended for demonstrating CVE-2023-36664.

docker-compose.yml:1-14Dockerfile:1-33README.md:1-254

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a lab for CVE-2023-36664, a Ghostscript RCE vulnerability. The Dockerfile builds a vulnerable Ghostscript version, and the Compose file mounts a PoC script. The entire setup is designed to reproduce and demonstrate the vulnerability.

README.md:1-10Dockerfile:10-16poc.py:1-2
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

gs-lab

vulnerable targetexploit exercise environment

The single service defined in docker-compose.yml. It builds from the local Dockerfile, runs with host networking, mounts the host X11 socket and the PoC script, and provides an interactive bash shell as the test user.

docker-compose.yml:4-14

Ghostscript 10.01.1

vulnerable application

A specific vulnerable version of Ghostscript downloaded and built from source inside the container. It is the target of the CVE-2023-36664 exploit.

Dockerfile:10-16README.md:5-6

poc.py

exploit generator

A Python script mounted into the container that generates malicious PostScript (.ps) or Encapsulated PostScript (.eps) files. It crafts a payload using the %pipe% prefix to exploit the Ghostscript vulnerability.

poc.py:1-76docker-compose.yml:11

/var/www/html/config.php

simulated sensitive target file

A file created during the Docker build containing a hardcoded database password. It serves as a target for the exploit demonstration, showing how an attacker could read sensitive files.

Dockerfile:18-19README.md:148-150
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-34446

Contradicted by supplied evidence

The repository name and canonical identifiers suggest CVE-2023-34446, but all unit content (README, PoC script) explicitly and exclusively references CVE-2023-36664. No evidence within the packet supports CVE-2023-34446.

README.md:1poc.py:1
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.README.md:160-162
  • Host X11 display server running (for gedit GUI).docker-compose.yml:8-10README.md:120-122
  • Host network access to download Ghostscript source during build.Dockerfile:10-11

Evidence-described exercise path

  1. Build and start the container using docker compose.README.md:160-162
  2. Execute into the running container as the test user.README.md:164-165
  3. Run poc.py to generate a malicious PostScript file containing a %pipe% payload.README.md:170-172
  4. Process the malicious file with Ghostscript using the -dNOSAFER flag to trigger the vulnerability.README.md:180-182
  5. Observe the result: gedit opens and displays the contents of /var/www/html/config.php.README.md:184-190
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target container. The exploit reads a simulated sensitive file inside the container and opens gedit via the mounted X11 socket, which is a documented part of the exercise. There is no evidence of host compromise, external communication, persistence, or any action outside the intended lab scope.

README.md:160-190poc.py:1-76Dockerfile:1-33
Review boundaries

What the analysis did not establish

  • The repository name and canonical identifiers reference CVE-2023-34446, but all unit content describes CVE-2023-36664. This mismatch is noted but does not affect the safety assessment.
  • The Docker Compose file uses host networking and mounts the host X11 socket, which are risky configurations but are documented prerequisites for the GUI-based demonstration.
  • The exercise requires running Ghostscript with -dNOSAFER, which disables the default sandbox. This is a necessary step for the exploit and is explicitly documented.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

2