CVE-2023-29944
📋 TL;DR
Metersphere v1.20.20-lts-79d354a6 contains a remote command execution vulnerability in the custom code snippet function of the system workbench. Attackers can execute arbitrary system commands, potentially gaining full control of affected servers. Organizations running vulnerable Metersphere instances are affected.
💻 Affected Systems
- Metersphere
📦 What is this software?
Metersphere by Metersphere
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, install malware, exfiltrate data, pivot to internal networks, and maintain persistent access.
Likely Case
Attackers gain shell access to the Metersphere server, allowing them to steal credentials, manipulate test data, and potentially access connected systems.
If Mitigated
Limited impact due to network segmentation, strict access controls, and monitoring that detects exploitation attempts.
🎯 Exploit Status
The vulnerability allows remote command execution without authentication. Public proof-of-concept references exist, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Metersphere GitHub repository for latest secure version
Vendor Advisory: https://github.com/metersphere/metersphere
Restart Required: Yes
Instructions:
1. Check current Metersphere version. 2. Update to latest secure version from official repository. 3. Restart Metersphere services. 4. Verify the fix by testing the custom code snippet function.
🔧 Temporary Workarounds
Disable Custom Code Snippet Function
allTemporarily disable the vulnerable custom code snippet function in the system workbench
Modify Metersphere configuration to disable custom code execution
Network Access Restrictions
allRestrict access to Metersphere interface to trusted IP addresses only
Configure firewall rules to limit access to Metersphere port
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Metersphere from critical systems
- Enable comprehensive logging and monitoring for suspicious command execution attempts
🔍 How to Verify
Check if Vulnerable:
Check if running Metersphere v1.20.20-lts-79d354a6 and test if custom code snippet function allows system command executionCheck Version:
Check Metersphere web interface or configuration files for version informationVerify Fix Applied:
After patching, attempt to execute system commands through the custom code snippet function to confirm they are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual system command execution in Metersphere logs
- Suspicious process creation from Metersphere user
- Failed authentication attempts followed by command execution
Network Indicators:
- Unexpected outbound connections from Metersphere server
- Reverse shell connections from Metersphere port
SIEM Query:
search 'Metersphere' AND ('command execution' OR 'reverse shell' OR 'system call')