CVE-2023-39346
📋 TL;DR
CVE-2023-39346 is a remote code execution vulnerability in LinuxASMCallGraph software that allows attackers to execute arbitrary code on the server by uploading a specially crafted ZIP file. The vulnerability affects all versions before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 due to insufficient file upload filtering. Organizations using LinuxASMCallGraph for code analysis are at risk.
💻 Affected Systems
- LinuxASMCallGraph
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing attacker to execute arbitrary commands, install malware, exfiltrate data, or pivot to other systems in the network.
Likely Case
Server compromise leading to data theft, service disruption, or use as a foothold for further attacks within the network.
If Mitigated
Limited impact with proper network segmentation and file upload restrictions, potentially only affecting the application service.
🎯 Exploit Status
Exploitation requires only file upload capability, which is typically available to users. No authentication bypass is needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 20dba06bd1a3cf260612d4f21547c25002121cd5
Vendor Advisory: https://github.com/bjrjk/LinuxASMCallGraph/security/advisories/GHSA-63c3-r9qm-c2wx
Restart Required: Yes
Instructions:
1. Pull the latest code from the GitHub repository. 2. Apply commit 20dba06bd1a3cf260612d4f21547c25002121cd5. 3. Restart the LinuxASMCallGraph service. 4. Verify the fix by checking the commit hash.
🔧 Temporary Workarounds
Disable File Upload
linuxTemporarily disable file upload functionality in LinuxASMCallGraph configuration
# Edit configuration to disable uploads or remove upload endpoints
Web Application Firewall Rules
allImplement WAF rules to block malicious ZIP file uploads
# Configure WAF to inspect and block suspicious ZIP file uploads
🧯 If You Can't Patch
- Isolate the LinuxASMCallGraph server in a restricted network segment with no internet access
- Implement strict file upload validation and sanitization at the application level
🔍 How to Verify
Check if Vulnerable:
Check if your LinuxASMCallGraph version is before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 by examining the git commit history or version metadata.Check Version:
git log --oneline -1Verify Fix Applied:
Verify the current commit hash matches or is after 20dba06bd1a3cf260612d4f21547c25002121cd5 using 'git log --oneline -1' in the installation directory.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload patterns
- Large or malformed ZIP file uploads
- Suspicious process execution following file uploads
Network Indicators:
- Unexpected outbound connections from LinuxASMCallGraph server
- Unusual traffic patterns to/from the application
SIEM Query:
source="linuxasmcallgraph.log" AND (event="file_upload" AND file_extension="zip" AND file_size>1000000) OR (process_execution AND parent_process="linuxasmcallgraph")🔗 References
- https://github.com/bjrjk/LinuxASMCallGraph/commit/20dba06bd1a3cf260612d4f21547c25002121cd5
- https://github.com/bjrjk/LinuxASMCallGraph/issues/6
- https://github.com/bjrjk/LinuxASMCallGraph/issues/8
- https://github.com/bjrjk/LinuxASMCallGraph/security/advisories/GHSA-63c3-r9qm-c2wx
- https://github.com/bjrjk/LinuxASMCallGraph/commit/20dba06bd1a3cf260612d4f21547c25002121cd5
- https://github.com/bjrjk/LinuxASMCallGraph/issues/6
- https://github.com/bjrjk/LinuxASMCallGraph/issues/8
- https://github.com/bjrjk/LinuxASMCallGraph/security/advisories/GHSA-63c3-r9qm-c2wx
