CVE-2023-33960
Published: 01 June 2023
Summary
CVE-2023-33960 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Openproject Openproject. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 2.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
OpenProject is a web-based project management application that automatically generates a robots.txt file listing routes that crawlers should avoid. Prior to version 12.5.6, this file included the identifiers of every public project on the instance and remained accessible at the unauthenticated /robots.txt endpoint even when the entire installation was configured to require login and block all anonymous access. The issue is tracked as CVE-2023-33960 with a CVSS 3.1 score of 7.5 and is classified under CWE-200 and CWE-319.
An unauthenticated attacker can simply retrieve the robots.txt file to enumerate project identifiers that would otherwise be hidden behind the login requirement. This information disclosure can be used for targeted follow-on attacks against the listed projects or to map the attack surface of an otherwise non-public OpenProject deployment.
The official fix is included in OpenProject 12.5.6; a patch is also available for any version greater than 10.0. As a workaround, administrators can convert public projects to non-public and grant access only through explicit memberships. The referenced GitHub advisory and pull request provide the detailed change set.
EPSS for the vulnerability reached a peak of 0.4625, indicating measurable exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-38091
Vulnerability details
OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server to denote which routes shall or shall not be accessed by crawlers. These routes contain project identifiers of all public projects in…
more
the instance. Prior to version 12.5.6, even if the entire instance is marked as `Login required` and prevents all truly anonymous access, the `/robots.txt` route remains publicly available. Version 12.5.6 has a fix for this issue. Alternatively, users can download a patchfile to apply the patch to any OpenProject version greater than 10.0 As a workaround, one may mark any public project as non-public and give anyone in need of access to the project a membership.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
A data action map identifies locations where sensitive information may be exposed to unauthorized actors during processing or transfer.
The media protection policy defines requirements and procedures to prevent unauthorized disclosure or access to sensitive information on media.
Policies mandate protection of CUI on external systems, directly reducing unauthorized exposure of sensitive information.
Out-of-band delivery transmits sensitive data on a separate path, directly reducing exposure to unauthorized actors on the primary channel.
Wireless link protection (encryption, directional transmission, etc.) directly prevents unauthorized actors from observing transmitted data.
Automated marking applies security attributes to system outputs, making it harder for attackers to exploit unmarked sensitive information leading to unauthorized exposure.
Proper attribute retention and permitted-value enforcement limits unauthorized actors from accessing sensitive information lacking correct labels.
Prevents unauthorized exposure of sensitive information by prohibiting untrusted external systems from processing or storing it.