CVE-2023-42335
📋 TL;DR
An unrestricted file upload vulnerability in Fl3xx Dispatch and Crew versions 2.10.37 allows remote attackers to upload malicious files via the add attachment function in the New Expense component. This can lead to arbitrary code execution on the server. All users running the vulnerable versions are affected.
💻 Affected Systems
- Fl3xx Dispatch
- Fl3xx Crew
📦 What is this software?
Crew by Fl3xx
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to data theft, lateral movement, ransomware deployment, or complete system takeover.
Likely Case
Webshell deployment allowing persistent access, data exfiltration, or use as a foothold for further attacks.
If Mitigated
File uploads blocked or sanitized, preventing malicious file execution while maintaining legitimate functionality.
🎯 Exploit Status
Exploitation requires authenticated access to the New Expense component; detailed write-up available in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.10.37
Vendor Advisory: Not publicly documented in vendor advisory
Restart Required: Yes
Instructions:
1. Update Fl3xx Dispatch and Crew to latest version. 2. Restart application services. 3. Verify file upload restrictions are enforced.
🔧 Temporary Workarounds
Implement File Upload Restrictions
allConfigure web server or application to restrict file uploads to specific extensions and validate file content.
Disable New Expense Attachment Feature
allTemporarily disable the vulnerable add attachment function until patching is complete.
🧯 If You Can't Patch
- Implement strict file upload validation at the web application firewall (WAF) level.
- Isolate affected systems from critical network segments and monitor for suspicious file uploads.
🔍 How to Verify
Check if Vulnerable:
Check application version in settings; if running 2.10.37, test file upload with malicious extensions.Check Version:
Check application version in Fl3xx admin panel or configuration files.Verify Fix Applied:
After update, attempt to upload a file with executable extension; it should be blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads with executable extensions (e.g., .php, .jsp, .exe)
- Multiple failed upload attempts from single user
Network Indicators:
- HTTP POST requests to attachment upload endpoints with suspicious file types
SIEM Query:
source="web_logs" AND (url_path="/new_expense/attachment" OR file_extension IN ("php", "jsp", "exe"))