CVE-2023-50094
Published: 01 January 2024
Summary
CVE-2023-50094 is a high-severity OS Command Injection (CWE-78) vulnerability in Yogeshojha Rengine. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
reNgine versions prior to 2.1.2 contain an OS command injection vulnerability tracked as CVE-2023-50094 and CWE-78. The flaw resides in the api/tools/waf_detector endpoint, where unsanitized input supplied to the url parameter is passed directly to subprocess.check_output, allowing shell metacharacters to be interpreted and executed with root privileges.
An authenticated attacker possessing a valid session ID can exploit the issue over the network by crafting a malicious url value. Successful exploitation yields arbitrary command execution on the underlying host, resulting in full confidentiality, integrity, and availability impact as reflected by the CVSS 3.1 base score of 8.8.
The referenced commits 3d5f1724dd12cf9861443742e7d7c02ff8c75a6f and edd3c85ee16f93804ad38dac5602549d2d30a93e, together with the 2.1.2 release, address the injection by correcting the handling of the affected API view. The current EPSS score of 0.8856 with a recorded peak of 0.9249 indicates sustained exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-54924
Vulnerability details
reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.