CVE-2023-31465

critical · 9.8

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call. Some query parameters are passed directly in the URL and named arg[x], with x an integer starting from 1; it is possible to modify arg[2] to insert Bash code that will be executed directly by the server.

9.8

CVSS

46.3%

EPSS (exploit prob.)

99th

EPSS percentile

2023-07-26

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Affected versions
fsmlabs	timekeeper	>= 8.0.17, <= 8.0.28

Check a specific version with /api/v1/cve/match.

References

https://fsmlabs.com/fsmlabs-cybersecurity/
https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2023-31465.md
https://fsmlabs.com/fsmlabs-cybersecurity/
https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2023-31465.md

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-31465