Vulnerability · Published Apr 24, 2023 · Assigned by GitHub_M
CVE-2023-30613Kiwi TCMS unrestricted file upload vulnerability
High 8.1
In plain English
A high-severity unrestricted file upload in Kiwi from kiwitcms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Kiwi TCMS, an open source test management system, allows users to upload attachments to test plans, test cases, etc. In versions of Kiwi TCMS prior to 12.2, there is no control over what kinds of files can be uploaded. Thus, a malicious actor may upload an `.exe` file or a file containing embedded JavaScript and trick others into clicking on these files, causing vulnerable browsers to execute malicious code on another computer. Kiwi TCMS v12.2 comes with functionality that allows administrators to configure additional upload validator functions which give them more control over what file types are accepted for upload. By default `.exe` are denied. Other files containing the `<script>` tag, regardless of their type are also denied b/c they are a path to XSS attacks. There are no known workarounds aside from upgrading.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | kiwitcms | 12.2 | GHSA-fwcf-753v-fgcj |
| PyPI | kiwitcms | 12.2 | PYSEC-2026-1498 |
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-fwcf-753v-fgcj x_refsource_CONFIRM
- https://huntr.dev/bounties/c30d3503-600d-4d00-9571-98826a51f12c x_refsource_MISC
- https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122/ x_refsource_MISC
- https://huntr.com/bounties/c30d3503-600d-4d00-9571-98826a51f12c exploit