CVE-2023-47246
CRITICAL KEV RANSOMWARE NUCLEISysAid < 23.3.36 - Path Traversal and Remote Code Execution via Tomcat Webroot File Write
Title source: llmExploitation Summary
CVE-2023-47246 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 13, 2023, with confirmed use in ransomware campaigns. EIP tracks 4 public exploits from researchers including W01fh4cker, tucommenceapousser, mdelaclaire. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains a functional exploit for CVE-2023-47246, which targets a vulnerability in Apache Tomcat. The exploit involves compressing a malicious WAR file, generating a hex-encoded payload, and sending it to the target server to achieve remote code execution (RCE).
Description
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.
Exploits (4)
The repository contains a functional exploit for CVE-2023-47246, which targets a vulnerability in Apache Tomcat. The exploit involves compressing a malicious WAR file, generating a hex-encoded payload, and sending it to the target server to achieve remote code execution (RCE).
The repository lacks actual exploit code and instead provides instructions to clone and run an external script. It includes vague marketing language and references external downloads, which are indicators of a potential social engineering lure.
The repository contains a functional exploit for CVE-2023-47246, which appears to target a vulnerability in a web application. The exploit involves compressing a malicious file into a WAR archive, generating a hex-encoded payload, and sending it to the target with randomized directory names and user agents to evade detection.
The repository lacks actual exploit code and instead provides generic instructions for cloning and running a script, with no technical details about the vulnerability. It includes external links and vague commands without demonstrating any understanding of CVE-2023-47246.
Nuclei Templates (1)
http.favicon.hash:1540720428 || http.favicon.hash:"1540720428"
icon_hash="1540720428"
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H