CVE-2023-27372 : SPIP before 4.2.1 allows Remote Code Execution via form values in the public are

SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.

Published 2023-02-28 20:15:10

Updated 2023-06-21 18:15:13

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2023-27372

Debian » Debian Linux » Version: 11.0
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Matching versions
Spip » Spip
Versions from including (>=) 4.1.0 and before (<) 4.1.8
cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*
Matching versions
Spip » Spip
Versions from including (>=) 4.0.0 and before (<) 4.0.10
cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*
Matching versions
Spip » Spip
Versions before (<) 3.2.18
cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 4.2.0 Update Alpha2
cpe:2.3:a:spip:spip:4.2.0:alpha2:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 4.2.0 Update Alpha
cpe:2.3:a:spip:spip:4.2.0:alpha:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 4.2.0
cpe:2.3:a:spip:spip:4.2.0:-:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2023-27372

Top countries where our scanners detected CVE-2023-27372

Top open port discovered on systems with this issue 80

IPs affected by CVE-2023-27372 91

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2023-27372!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2023-27372

EPSS FAQ

97.39%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2023-27372

SPIP form PHP Injection

Disclosure Date: 2023-02-27

First seen: 2024-09-12

exploit/multi/http/spip_rce_form

This module exploits a PHP code injection in SPIP. The vulnerability exists in the oubli parameter and allows an unauthenticated user to execute arbitrary commands with web user privileges. Branches 3.2, 4.0, 4.1 and 4.2 are concerned. Vulnerable versions are

More information
SPIP form PHP Injection

Disclosure Date: 2023-02-27

First seen: 2023-09-11

exploit/unix/webapp/spip_rce_form

This module exploits a PHP code injection in SPIP. The vulnerability exists in the oubli parameter and allows an unauthenticated user to execute arbitrary commands with web user privileges. Branches 3.2, 4.0, 4.1 and 4.2 are concerned. Vulnerable versions are

More information

CVSS scores for CVE-2023-27372

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2023-27372

https://git.spip.net/spip/spip/commit/96fbeb38711c6706e62457f2b732a652a04a409d

Fix: Sanitizer toutes les valeurs passées aux formulaires · 96fbeb3871 - spip - SPIP on GIT
Patch
https://git.spip.net/spip/spip/commit/5aedf49b89415a4df3eb775eee3801a2b4b88266

Fix: Sanitizer toutes les valeurs passées aux formulaires · 5aedf49b89 - spip - SPIP on GIT
Patch
https://www.debian.org/security/2023/dsa-5367

Debian -- Security Information -- DSA-5367-1 spip
Third Party Advisory
http://packetstormsecurity.com/files/173044/SPIP-4.2.1-Remote-Code-Execution.html

SPIP 4.2.1 Remote Code Execution ≈ Packet Storm
https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIP-4-1-8-SPIP-4-0-10-et.html

Mise à jour critique de sécurité : sortie de SPIP 4.2.1, SPIP 4.1.8, SPIP (...) - SPIP Blog
Release Notes
http://packetstormsecurity.com/files/171921/SPIP-Remote-Command-Execution.html

SPIP Remote Command Execution ≈ Packet Storm

Jump to

Vulnerability Details : CVE-2023-27372