CVE-2023-4760: Remote Code Execution in Eclipse RAP on Windows
First published: Thu Sep 21 2023(Updated: )
In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. The reason for this is a not completely secure extraction of the file name in the FileUploadProcessor.stripFileName(String name) method. As soon as this finds a / in the path, everything before it is removed, but potentially \ (backslashes) coming further back are kept. For example, a file name such as /..\..\webapps\shell.war can be used to upload a file to a Tomcat server under Windows, which is then saved as ..\..\webapps\shell.war in its webapps directory and can then be executed.
Credit: emo@eclipse.org emo@eclipse.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Eclipse Remote Application Platform | >=3.0.0<=3.25.0 | |
| >=3.0.0<=3.25.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-4760?
The severity of CVE-2023-4760 is critical.
How does CVE-2023-4760 affect Eclipse RAP?
CVE-2023-4760 affects Eclipse RAP versions from 3.0.0 up to and including 3.25.0.
How can Remote Code Execution be possible in CVE-2023-4760?
Remote Code Execution is possible in CVE-2023-4760 due to a not completely secure extraction of the file name in the FileUploadProcessor.stripFileName() method.
What is the Common Weakness Enumeration (CWE) ID of CVE-2023-4760?
CVE-2023-4760 has CWE IDs 22 and 23.
Are there any references for CVE-2023-4760?
Yes, you can find references for CVE-2023-4760 at the following links: 1. [https://github.com/eclipse-rap/org.eclipse.rap/pull/141](https://github.com/eclipse-rap/org.eclipse.rap/pull/141) 2. [https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/160](https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/160)
- collector/nvd-index
- agent/author
- agent/references
- agent/type
- agent/remedy
- agent/severity
- agent/title
- agent/weakness
- agent/first-publish-date
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/eclipse
- canonical/eclipse remote application platform
- version/eclipse remote application platform/3.0.0
- version/eclipse remote application platform/3.25.0