CVE-2023-2564
📋 TL;DR
This CVE describes an OS command injection vulnerability in scanservjs web scanning software that allows attackers to execute arbitrary commands on the host system. The vulnerability affects all users running scanservjs versions prior to 2.27.0. Attackers can exploit this to gain unauthorized access and control over the affected system.
💻 Affected Systems
- scanservjs
📦 What is this software?
Scanservjs by Scanservjs Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to execute arbitrary commands as the scanservjs process user, potentially leading to privilege escalation, data theft, or installation of persistent backdoors.
Likely Case
Unauthorized command execution leading to file system access, service disruption, or lateral movement within the network.
If Mitigated
Limited impact if scanservjs runs with minimal privileges in a containerized or isolated environment with proper network segmentation.
🎯 Exploit Status
The vulnerability is well-documented with public proof-of-concept available. Exploitation requires sending specially crafted requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.27.0 and later
Vendor Advisory: https://github.com/sbs20/scanservjs/pull/606/commits/d51fd52c1569813990b8f74e64ae6979c665dca1
Restart Required: Yes
Instructions:
1. Stop the scanservjs service. 2. Update to version 2.27.0 or later using npm: 'npm update scanservjs'. 3. Restart the scanservjs service.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict network access to scanservjs service to only trusted IP addresses
iptables -A INPUT -p tcp --dport 8080 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
Run with Minimal Privileges
linuxRun scanservjs as a non-privileged user to limit potential damage
sudo -u scanservjs_user node /path/to/scanservjs
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Run scanservjs in a containerized environment with limited capabilities
🔍 How to Verify
Check if Vulnerable:
Check scanservjs version: 'npm list scanservjs' or examine package.json. If version is below 2.27.0, system is vulnerable.Check Version:
npm list scanservjs | grep scanservjsVerify Fix Applied:
Confirm version is 2.27.0 or higher: 'npm list scanservjs | grep scanservjs' should show version >=2.27.0📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns in system logs
- Suspicious process creation from scanservjs user
- Unexpected network connections from scanservjs process
Network Indicators:
- Unusual HTTP requests to scanservjs endpoints with command injection patterns
- Outbound connections from scanservjs to unexpected destinations
SIEM Query:
source="scanservjs" AND (url="*;*" OR url="*|*" OR url="*`*" OR url="*$(*" OR url="*%3B*" OR url="*%7C*")🔗 References
- https://github.com/sbs20/scanservjs/pull/606/commits/d51fd52c1569813990b8f74e64ae6979c665dca1
- https://huntr.dev/bounties/d13113ad-a107-416b-acc1-01e4c16ec461
- https://github.com/sbs20/scanservjs/pull/606/commits/d51fd52c1569813990b8f74e64ae6979c665dca1
- https://huntr.dev/bounties/d13113ad-a107-416b-acc1-01e4c16ec461
