Automate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application
CVE-2023-40050

9.9CRITICAL

Key Information:

Vendor

Progress Software
Status
Chef Automate
Vendor
CVE Published:
31 October 2023

What is CVE-2023-40050?

A vulnerability exists in Chef Automate, allowing remote code execution due to the ability to upload a maliciously crafted profile via the API or user interface. This affects versions prior to and including 4.10.29, where executing a check command in InSpec can lead to unauthorized access and exploitation of system resources.

Affected Version(s)

Chef Automate Linux 4.0.0 <= 4.10.29

References

https://docs.chef.io/release_notes_automate/
release-notes
https://docs.chef.io/automate/profiles/
release-notes
https://community.progress.com/s/article/Product-Alert-Bu...
vendor-advisory

EPSS Score

9% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HackerOne - tas50
JSON
.