SB2023070730 - Multiple vulnerabilities in Milesight VPN 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023070730

SB2023070730 - Multiple vulnerabilities in Milesight VPN

Published: July 7, 2023

Security Bulletin ID SB2023070730
Severity
High
Patch available
NO
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 17% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 secuirty vulnerabilities.


1) SQL injection (CVE-ID: CVE-2023-22319)

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the requestHandlers.js LoginAuth functionality. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.


2) Cross-site scripting (CVE-ID: CVE-2023-24497)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the remote_subnet field in the requestHandlers.js detail_device functionality. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


3) Cross-site scripting (CVE-ID: CVE-2023-24496)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the name field in the requestHandlers.js detail_device functionality. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


4) Use of Hard-coded Cryptographic Key (CVE-ID: CVE-2023-22844)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a hardcoded encryption key in the requestHandlers.js verifyToken functionality. A remote attacker can use a specially crafted network request and bypass authentication.


5) Path traversal (CVE-ID: CVE-2023-23907)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the server.js start functionality. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.


6) OS Command Injection (CVE-ID: CVE-2023-22371)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the liburvpn.so create_private_key functionality. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References