CVE-2023-1304 - Vulnerability Details - OpenCVE

An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00159.

Exploitation poc

Automatable no

Technical Impact total

Vendors	Products
Rapid7	Insightappsec Insightcloudsec

Configuration 1 [-]

OR	cpe:2.3:a:rapid7:insightappsec:::::self-managed:::*
	cpe:2.3:a:rapid7:insightcloudsec:::::managed:::*
	cpe:2.3:a:rapid7:insightcloudsec:::::saas:::*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-23566	An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://docs.divvycloud.com/changelog/23321-release-notes
https://nephosec.com/exploiting-rapid7s-insightcloudsec/

History

Tue, 25 Feb 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: rapid7

Published: 2023-03-21T16:45:49.560Z

Updated: 2025-02-25T18:54:46.491Z

Reserved: 2023-03-09T22:23:14.145Z

Link: CVE-2023-1304

Vulnrichment

Updated: 2024-08-02T05:41:00.275Z

NVD

Status : Modified

Published: 2023-03-21T17:15:11.557

Modified: 2025-02-25T19:15:12.393

Link: CVE-2023-1304

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-1304", "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "state": "PUBLISHED", "assignerShortName": "rapid7", "dateReserved": "2023-03-09T22:23:14.145Z", "datePublished": "2023-03-21T16:45:49.560Z", "dateUpdated": "2025-02-25T18:54:46.491Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "InsightCloudSec", "vendor": "Rapid7", "versions": [{"lessThanOrEqual": "23.2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Mike Alfaro of Nephosec"}], "datePublic": "2023-03-21T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.<br><br>"}], "value": "An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.\n\n"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7", "dateUpdated": "2023-03-21T16:45:49.560Z"}, "references": [{"tags": ["release-notes"], "url": "https://docs.divvycloud.com/changelog/23321-release-notes"}, {"tags": ["third-party-advisory"], "url": "https://nephosec.com/exploiting-rapid7s-insightcloudsec/"}], "source": {"discovery": "UNKNOWN"}, "title": "Rapid7 InsightCloudSec getattr() method access", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:41:00.275Z"}, "title": "CVE Program Container", "references": [{"tags": ["release-notes", "x_transferred"], "url": "https://docs.divvycloud.com/changelog/23321-release-notes"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://nephosec.com/exploiting-rapid7s-insightcloudsec/"}]}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-02-25T18:54:06.125461Z", "id": "CVE-2023-1304", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-25T18:54:46.491Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://docs.divvycloud.com/changelog/23321-release-notes", "tags": ["release-notes", "x_transferred"]}, {"url": "https://nephosec.com/exploiting-rapid7s-insightcloudsec/", "tags": ["third-party-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:41:00.275Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-1304", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-25T18:54:06.125461Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-25T18:54:24.455Z"}}], "cna": {"title": "Rapid7 InsightCloudSec getattr() method access", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Mike Alfaro of Nephosec"}], "affected": [{"vendor": "Rapid7", "product": "InsightCloudSec", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "23.2.0"}], "defaultStatus": "unaffected"}], "datePublic": "2023-03-21T16:00:00.000Z", "references": [{"url": "https://docs.divvycloud.com/changelog/23321-release-notes", "tags": ["release-notes"]}, {"url": "https://nephosec.com/exploiting-rapid7s-insightcloudsec/", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.\n\n", "supportingMedia": [{"type": "text/html", "value": "An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.<br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7", "dateUpdated": "2023-03-21T16:45:49.560Z"}}}, "cveMetadata": {"cveId": "CVE-2023-1304", "state": "PUBLISHED", "dateUpdated": "2025-02-25T18:54:46.491Z", "dateReserved": "2023-03-09T22:23:14.145Z", "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "datePublished": "2023-03-21T16:45:49.560Z", "assignerShortName": "rapid7"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rapid7:insightappsec:*:*:*:*:self-managed:*:*:*", "matchCriteriaId": "65FCB38E-8FDE-43D4-A62E-BBAD43FFBC97", "versionEndExcluding": "23.2.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:rapid7:insightcloudsec:*:*:*:*:managed:*:*:*", "matchCriteriaId": "2005649C-D913-4281-9E35-6E342C7E6D21", "versionEndExcluding": "2023.02.01", "vulnerable": true}, {"criteria": "cpe:2.3:a:rapid7:insightcloudsec:*:*:*:*:saas:*:*:*", "matchCriteriaId": "D88FD323-9DA9-497D-BC99-F30C66E33096", "versionEndExcluding": "2023.02.01", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.\n\n"}], "id": "CVE-2023-1304", "lastModified": "2025-02-25T19:15:12.393", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-03-21T17:15:11.557", "references": [{"source": "cve@rapid7.com", "tags": ["Release Notes"], "url": "https://docs.divvycloud.com/changelog/23321-release-notes"}, {"source": "cve@rapid7.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://nephosec.com/exploiting-rapid7s-insightcloudsec/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://docs.divvycloud.com/changelog/23321-release-notes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://nephosec.com/exploiting-rapid7s-insightcloudsec/"}], "sourceIdentifier": "cve@rapid7.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "cve@rapid7.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-94"}], "source": "nvd@nist.gov", "type": "Primary"}]}