CVE-2023-3722
HIGH EXPLOITED NUCLEIAvaya Aura Device Services < 8.1.4.0 - Remote Code Execution via Malicious File Upload
Title source: llmExploitation Summary
CVE-2023-3722 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including pizza-power. A Nuclei detection template is also available.
AI-analyzed exploit summary This Python script exploits CVE-2023-3722, an unrestricted file upload vulnerability in Avaya Aura Device Services, by uploading a malicious PHP file via a PUT request and executing it via a GET request to achieve remote code execution (RCE). The script generates a random filename to bypass basic detection and allows custom command execution through the --query argument.
Description
An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.
Exploits (1)
This Python script exploits CVE-2023-3722, an unrestricted file upload vulnerability in Avaya Aura Device Services, by uploading a malicious PHP file via a PUT request and executing it via a GET request to achieve remote code execution (RCE). The script generates a random filename to bypass basic detection and allows custom command execution through the --query argument.
Nuclei Templates (1)
html:"Avaya Aura® Utility Services"
body="Avaya Aura® Utility Services"
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H