CVE-2023-3375 in Bookreen
Summary
by MITRE • 09/05/2023
Unrestricted Upload of File with Dangerous Type vulnerability in Unisign Bookreen allows OS Command Injection.
This issue affects Bookreen: before 3.0.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/23/2026
The vulnerability identified as CVE-2023-3375 represents a critical security flaw in the Bookreen application that enables unauthorized users to upload files with potentially malicious content, specifically targeting operating system command injection attacks. This vulnerability exists within the file upload functionality of Bookreen versions prior to 3.0.0, creating a significant attack surface that could allow adversaries to execute arbitrary commands on the affected system. The flaw stems from inadequate validation and sanitization of file uploads, particularly when dealing with file types that could be interpreted as executable or scriptable content by the underlying operating system.
The technical implementation of this vulnerability occurs when the application fails to properly validate file extensions, content types, or file attributes during the upload process. Attackers can exploit this weakness by uploading files with dangerous extensions such as .php, .jsp, .asp, or other server-side include formats that the application might not adequately filter or reject. When these malicious files are processed or executed by the web server, they can trigger OS command injection attacks, allowing threat actors to execute arbitrary commands with the privileges of the web application user. This type of vulnerability falls under CWE-434 which specifically addresses unrestricted upload of files with dangerous types, and it directly enables the execution of commands through the operating system interface.
The operational impact of this vulnerability extends beyond simple data compromise, as it provides attackers with persistent access to the underlying system infrastructure. Once exploited, adversaries can establish backdoors, escalate privileges, exfiltrate sensitive data, or use the compromised system as a launch point for further attacks within the network. The vulnerability creates a persistent threat vector that can be leveraged for long-term system compromise, potentially leading to complete system takeover. Organizations relying on affected Bookreen versions face significant risk of unauthorized access, data breaches, and potential regulatory compliance violations due to the lack of proper file upload controls and validation mechanisms.
Security mitigations for this vulnerability should focus on implementing comprehensive file upload validation controls that align with industry best practices and standards. Organizations must deploy strict file type filtering mechanisms that reject uploads of dangerous file extensions and content types, while also implementing proper file name sanitization and content inspection procedures. The fix should include server-side validation that checks file headers, MIME types, and actual file content rather than relying solely on client-side or extension-based validation. Additionally, implementing proper access controls, least privilege principles, and regular security testing can help prevent exploitation of this vulnerability. Organizations should also consider implementing web application firewalls and monitoring systems to detect and prevent suspicious file upload activities that could indicate exploitation attempts. This vulnerability demonstrates the critical importance of secure coding practices and proper input validation in preventing command injection attacks, aligning with ATT&CK technique T1059.001 for command and script injection.