CVE-2023-33498
📋 TL;DR
CVE-2023-33498 is an access control vulnerability in Alist file listing software where low-privilege user accounts can upload any file type regardless of restrictions. This affects all Alist deployments running vulnerable versions, potentially allowing attackers to upload malicious files.
💻 Affected Systems
- Alist
📦 What is this software?
Alist by Alistgo
⚠️ Risk & Real-World Impact
Worst Case
Attackers upload webshells or malware to gain remote code execution, compromise the server, and pivot to internal networks.
Likely Case
Attackers upload malicious files to serve malware to users, deface websites, or exfiltrate sensitive data.
If Mitigated
File uploads are properly restricted, limiting damage to unauthorized file storage without code execution.
🎯 Exploit Status
Exploitation requires low-privilege account access; public proof-of-concept exists in referenced GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > 3.16.3
Vendor Advisory: https://github.com/alist-org/alist
Restart Required: Yes
Instructions:
1. Backup current Alist installation. 2. Update to Alist version 3.17.0 or later. 3. Restart the Alist service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Restrict file upload permissions
allModify user roles to remove upload permissions for low-privilege accounts
Edit Alist configuration to set 'allow_upload: false' for non-admin roles
Implement web application firewall rules
allBlock suspicious file upload patterns at the WAF level
🧯 If You Can't Patch
- Disable all non-admin user accounts until patching is possible
- Implement strict file type validation at reverse proxy or load balancer level
🔍 How to Verify
Check if Vulnerable:
Check Alist version; if version <= 3.16.3, system is vulnerable. Test with low-privilege account attempting to upload restricted file types.Check Version:
Check Alist web interface admin panel or run './alist version' in installation directoryVerify Fix Applied:
After update, verify version > 3.16.3 and test that low-privilege accounts cannot upload unauthorized file types.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads from low-privilege accounts
- Uploads of executable file types (.php, .exe, .sh) from non-admin users
Network Indicators:
- HTTP POST requests to upload endpoints from unauthorized user agents
- Unusual traffic patterns to uploaded files
SIEM Query:
source="alist.log" AND (event="file_upload" AND user_role!="admin")