High severity · published Mar 21, 2023
CVE-2023-1304
An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private…
8.8
CVSS
1.1%
EPSS
No
On KEV
Description
An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Insightappsec · Rapid7
before 23.2.1 · source: NVD
IN
Insightcloudsec · Rapid7
before 2023.02.01; before 2023.02.01 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-1304
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-1304
Release Notes
https://docs.divvycloud.com/changelog/23321-release-notes
Exploit
https://nephosec.com/exploiting-rapid7s-insightcloudsec/
More from Insightappsec
8.8
CVE-2023-1306
An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which can lead to code execution
8.1
CVE-2023-1305
An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON
7.8
CVE-2019-5631
The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product