CVE-2023-41638
📋 TL;DR
This vulnerability allows attackers to upload arbitrary files to the Gestione Documentale module in RealGimm 1.1.37p38, potentially leading to remote code execution. Organizations using this specific version of RealGimm's document management module are affected.
💻 Affected Systems
- GruppoSCAI RealGimm
📦 What is this software?
Realgimm by Grupposcai
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the server, data exfiltration, and lateral movement within the network.
Likely Case
Attackers upload web shells or malicious scripts to execute commands, steal sensitive data, or deploy ransomware.
If Mitigated
File uploads are blocked or properly validated, preventing malicious file execution while maintaining legitimate functionality.
🎯 Exploit Status
Exploitation requires access to the file upload functionality. The GitHub references contain detailed proof-of-concept information.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: Not found in provided references
Restart Required: No
Instructions:
1. Check vendor website for security updates
2. Apply any available patches for RealGimm 1.1.37p38
3. Verify the fix by testing file upload functionality
🔧 Temporary Workarounds
File Upload Restriction
allImplement strict file type validation and size limits on the Gestione Documentale module
Web Application Firewall Rules
allDeploy WAF rules to block malicious file upload patterns and suspicious requests
🧯 If You Can't Patch
- Disable or restrict access to the Gestione Documentale module entirely
- Implement network segmentation to isolate RealGimm servers from critical systems
🔍 How to Verify
Check if Vulnerable:
Check if RealGimm version is 1.1.37p38 and test file upload functionality with malicious file typesCheck Version:
Check RealGimm administration panel or configuration files for version informationVerify Fix Applied:
Test file upload with various file types to ensure only allowed extensions are accepted📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads, especially with executable extensions
- Multiple failed upload attempts
- Uploads from unexpected IP addresses
Network Indicators:
- HTTP POST requests to document upload endpoints with suspicious file names
- Traffic patterns indicating file upload exploitation
SIEM Query:
source="realgimm" AND (url="*upload*" OR url="*document*" OR method="POST") AND (file_extension="php" OR file_extension="jsp" OR file_extension="asp" OR file_extension="exe")🔗 References
- https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41638%20%7C%20RealGimm%20-%20RCE%20via%20Unrestricted%20File%20Upload.md
- https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-ID%20%7C%20RealGimm%20-%20RCE%20via%20Unrestricted%20File%20Upload.md
- https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41638%20%7C%20RealGimm%20-%20RCE%20via%20Unrestricted%20File%20Upload.md
- https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-ID%20%7C%20RealGimm%20-%20RCE%20via%20Unrestricted%20File%20Upload.md
