IrisEVTXModule Vulnerability: Remote Code Execution via Arbitrary File Write and Server Side Template Injection
CVE-2024-34060

8.8HIGH

Key Information:

Vendor

Dfir-iris

Status
Iris-evtx-module
Vendor
CVE Published:
23 May 2024

What is CVE-2024-34060?

The IrisEVTXModule serves as an interface for Evtx2Splunk, enabling the ingestion of Microsoft EVTX log files via the iris-web application. A vulnerability exists due to improper handling of filenames when uploading EVTX files, potentially allowing for Arbitrary File Write actions. This vulnerability poses a significant risk as it could be leveraged in conjunction with a Server Side Template Injection (SSTI) to achieve Remote Code Execution (RCE). A fix has been released in version 1.0.0 to address this issue.

Affected Version(s)

iris-evtx-module < 1.0.0

References

https://github.com/dfir-iris/iris-evtx-module/security/ad...
x_refsource_CONFIRM
https://github.com/dfir-iris/iris-evtx-module/commit/4e45...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-34060 : IrisEVTXModule Vulnerability: Remote Code Execution via Arbitrary File Write and Server Side Template Injection