CVE-2023-33480
Published: 07 November 2023
Summary
CVE-2023-33480 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Remoteclinic Remote Clinic. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 7.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
RemoteClinic 2.0 is affected by a vulnerability chain stemming from missing input validation and access control checks in the staff/register.php endpoint and the edit-my-profile.php page. The issues, tracked under CWE-434, allow an authenticated user to register accounts with elevated privileges and to upload arbitrary files, including PHP scripts, without sufficient restrictions.
An attacker possessing low-privileged credentials can exploit the flaws over the network to create administrative accounts, escalate to full administrative rights, upload a malicious PHP shell, and execute arbitrary commands on the server. The vulnerability carries a CVSS 3.1 score of 8.8, reflecting high impact on confidentiality, integrity, and availability.
Public references consist of GitHub issue reports that describe the same attack sequence but contain no details on patches or mitigation steps. The associated EPSS score has remained flat at 0.0940 with no observed increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-37643
Vulnerability details
RemoteClinic 2.0 contains a critical vulnerability chain that can be exploited by a remote attacker with low-privileged user credentials to create admin users, escalate privileges, and execute arbitrary code on the target system via a PHP shell. The vulnerabilities are…
more
caused by a lack of input validation and access control in the staff/register.php endpoint and the edit-my-profile.php page. By sending a series of specially crafted requests to the RemoteClinic application, an attacker can create admin users with more privileges than their own, upload a PHP file containing arbitrary code, and execute arbitrary commands via the PHP shell.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.