CVE-2023-4760
Last modified
CVE-2023-4760 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. The reason for this is a not completely secure extraction of the file name in the FileUploadProcessor.stripFileName(String name) method. As soon as this finds a / in the path, everything before it is removed, but potentially \ (backslashes) coming further back are kept. For example, a file name such as /..\..\webapps\shell.war can be used to upload a file to a Tomcat server under Windows, which is then saved as ..\..\webapps\shell.war in its webapps directory and can then be executed. . EPSS estimates a 1.04% chance of exploitation in the next 30 days.
Description
In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. The reason for this is a not completely secure extraction of the file name in the FileUploadProcessor.stripFileName(String name) method. As soon as this finds a / in the path, everything before it is removed, but potentially \ (backslashes) coming further back are kept. For example, a file name such as /..\..\webapps\shell.war can be used to upload a file to a Tomcat server under Windows, which is then saved as ..\..\webapps\shell.war in its webapps directory and can then be executed.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Eclipse | Remote Application Platform | >= 3.0.0, <= 3.25.0 |
References
- https://github.com/eclipse-rap/org.eclipse.rap/pull/141Issue Tracking, Patch
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/160Exploit, Issue Tracking
- https://github.com/eclipse-rap/org.eclipse.rap/pull/141Issue Tracking, Patch
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/160Exploit, Issue Tracking
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-4760?
How severe is CVE-2023-4760?
How do I fix CVE-2023-4760?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-47582Access of uninitialized pointer vulnerability exists in TELL…7.8
- CVE-2023-47583Multiple out-of-bounds read vulnerabilities exist in TELLUS …7.8
- CVE-2023-47584Out-of-bounds write vulnerability exists in V-Server V4.0.18…7.8
- CVE-2023-47585Out-of-bounds read vulnerability exists in V-Server V4.0.18.…7.8
- CVE-2023-47586Multiple heap-based buffer overflow vulnerabilities exist in…7.8
- CVE-2023-4759Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclips…8.8
- CVE-2023-47609SQL injection vulnerability in OSS Calendar versions prior t…8.8
- CVE-2023-4761Out of bounds memory access in FedCM in Google Chrome prior …8.1
- CVE-2023-47610A CWE-120: Buffer Copy without Checking Size of Input vulner…9.8
- CVE-2023-47611A CWE-269: Improper Privilege Management vulnerability exist…7.8
- CVE-2023-47612A CWE-552: Files or Directories Accessible to External Parti…6.1
- CVE-2023-47613A CWE-23: Relative Path Traversal vulnerability exists in Te…7.1
Are you affected by CVE-2023-4760?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST