NC3-LU TestingPlatform up to 2.1.0 input validation

Summaryinfo

A vulnerability, which was classified as very critical, has been found in NC3-LU TestingPlatform up to 2.1.0. Impacted is an unknown function. The manipulation leads to input validation. This vulnerability is referenced as CVE-2023-48310. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in NC3-LU TestingPlatform up to 2.1.0 (Testing Software). This issue affects an unknown functionality. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is integrity, and availability. The summary by CVE is:

TestingPlatform is a testing platform for Internet Security Standards. Prior to version 2.1.1, user input is not filtered correctly. Nmap options are accepted. In this particular case, the option to create log files is accepted in addition to a host name (and even without). A log file is created at the location specified. These files are created as root. If the file exists, the existing file is being rendered useless. This can result in denial of service. Version 2.1.1 contains a patch for this issue.

The weakness was published 11/21/2023 as GHSA-9fhc-f3mr-w6h6. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2023-48310 since 11/14/2023. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/14/2023).

Upgrading to version 2.1.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 7b3e7ca869a4845aa7445f874c22c5929315c3a7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Testing Software

Vendor

• NC3-LU

Name

• TestingPlatform

Version

• 2.0
• 2.1.0

License

• open-source

Website

• Product: https://github.com/NC3-LU/TestingPlatform/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion