CVE-2023-28725
Published: 22 March 2023
Summary
CVE-2023-28725 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Generalbytes Crypto Application Server. Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 25.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-28725 is an unrestricted file upload vulnerability (CWE-434) in General Bytes Crypto Application Server (CAS) version 20230120, shipped with General Bytes BATM cryptocurrency ATM devices. The flaw permits unauthenticated remote attackers to place arbitrary Java applications into the /batm/app/admin/standalone/deployments directory, resulting in remote code execution with high impact on confidentiality and integrity.
An attacker with network access can upload a malicious Java archive that the server automatically deploys and executes, enabling theft of cryptographic keys or draining of connected hot wallets. The issue was exploited in the wild in March 2023, with reported losses exceeding 1.5 million USD from compromised BATM devices.
Vendor advisories and release notes state that the vulnerability is resolved in CAS builds 20221118.48 and 20230120.44; operators are directed to apply these updates immediately and to restrict administrative deployment directories.
Public exploitation began shortly after disclosure, driving the EPSS score from a low baseline to a peak of 0.0934 before receding to the current value of 0.0082, indicating a clear but time-limited surge in attacker interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-32363
Vulnerability details
General Bytes Crypto Application Server (CAS) 20230120, as distributed with General Bytes BATM devices, allows remote attackers to execute arbitrary Java code by uploading a Java application to the /batm/app/admin/standalone/deployments directory, aka BATM-4780, as exploited in the wild in March…
more
2023. This is fixed in 20221118.48 and 20230120.44.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.