CVE-2023-25573
Published: 09 March 2023
Summary
CVE-2023-25573 is a high-severity Missing Authorization (CWE-862) vulnerability in Metersphere Metersphere. Its CVSS base score is 8.6 (High).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Metersphere, an open source continuous testing platform, is affected by an improper access control vulnerability (CWE-862) in the /api/jmeter/download/files endpoint. The flaw allows any caller to retrieve arbitrary files readable by the running process without authentication, exposing the full filesystem scope visible to the application.
An unauthenticated remote attacker can exploit the issue over the network to download any accessible file, resulting in high confidentiality impact with a scope change as reflected in the CVSS 8.6 rating. No user interaction or privileges are required.
The project’s GitHub security advisories state that the vulnerability is fixed in versions 1.20.20 LTS and 2.7.1, and they recommend immediate upgrade because no workarounds exist. The EPSS score has remained at its observed peak of 0.9363 with no material post-disclosure rise.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-29520
Vulnerability details
metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`, which allows any user to download any file without authentication. This issue may expose all files available to the running process.…
more
This issue has been addressed in version 1.20.20 lts and 2.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring an access control policy ensures authorization checks are defined and applied for critical functions.
Reviews of access controls detect missing authorization checks on critical functions or resources.
Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.
Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.
Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.
Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.
The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.
Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.