CVE-2023-50094

HIGHNuclei

reNgine 2.2.0 - Command Injection

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-50094 has a selected CVSS score of 8.8 (high); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 8, 2024 · Source: CVE List

Proofs of concept

1

Repository PoCs

GitHubZierax/CVE-2023-50094_POCRepository PoCby Zierax1Not analyzed2 files

3.5 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHreNgine 2.2.0 - Command InjectionCVSS 8.8

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.

Impact

Authenticated attackers can inject arbitrary OS commands that execute as root, leading to complete system compromise and data exfiltration.

Remediation

Upgrade reNgine to version 2.1.2 or later which includes proper input validation.

WeaknessesCWE-78
AuthorsZierax
Template tagscvecve2023renginerceinjectionauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:yogeshojha:rengine:*:*:*:*:*:*:*:*
Shodan: title:"reNgine"
https://github.com/yogeshojha/rengine https://github.com/Zierax/CVE-2023-50094_POC https://nvd.nist.gov/vuln/detail/CVE-2023-50094

Source: ProjectDiscovery

References

9