CVE-2023-40051: Progress OpenEdge Path Traversal Flaw

CVE-2023-40051 Overview

CVE-2023-40051 is a critical arbitrary file upload vulnerability affecting Progress Application Server (PAS) for OpenEdge. The vulnerability allows an attacker to formulate a request for a WEB transport that enables unintended file uploads to a server directory path on systems running PASOE. If the uploaded file contains a malicious payload, it could be leveraged to further exploit the server or its network, potentially enabling a larger scale attack.

Critical Impact

Attackers can upload arbitrary files to server directories, potentially achieving remote code execution and full system compromise on affected Progress Application Server deployments.

Affected Products

• Progress OpenEdge versions 11.7 prior to 11.7.18
• Progress OpenEdge versions 12.2 prior to 12.2.13
• Progress OpenEdge Innovation releases prior to 12.8.0

Discovery Timeline

• 2024-01-18 - CVE CVE-2023-40051 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-40051

Vulnerability Analysis

This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw resides in the WEB transport component of Progress Application Server for OpenEdge (PASOE), which fails to properly validate and restrict file uploads. This weakness allows authenticated attackers to bypass intended file upload restrictions and place arbitrary files in server directories.

The vulnerability is particularly dangerous because it affects the application server layer, which typically has elevated privileges and network access. Once a malicious file is uploaded to the server, it can be executed or leveraged to compromise the underlying system, access sensitive data, or pivot to other systems within the network.

Root Cause

The root cause of CVE-2023-40051 is improper input validation in the WEB transport handler of PASOE. The application server does not adequately verify the type, content, or destination path of uploaded files. This allows attackers to craft specially formatted requests that bypass security controls designed to restrict file uploads to safe locations and file types.

Attack Vector

The attack is conducted over the network and requires low-privilege authentication to the affected system. An attacker would craft a malicious HTTP request targeting the WEB transport interface of PASOE. The request would contain a file payload along with manipulated parameters that direct the server to store the file in an attacker-controlled directory path.

Once the malicious file is uploaded, it can be used in various ways depending on its content:

• Web shells can provide persistent remote access
• Executable payloads can achieve code execution
• Configuration files can modify server behavior
• The uploaded files can serve as staging for lateral movement within the network

Detection Methods for CVE-2023-40051

Indicators of Compromise

• Unusual file creation events in PASOE server directories, especially webapps or application deployment folders
• Unexpected files with executable extensions (.jsp, .war, .class, .sh, .bat) appearing in server paths
• Anomalous HTTP POST requests to WEB transport endpoints with large payloads or suspicious content types
• New or modified files in server directories that do not match expected deployment patterns

Detection Strategies

• Monitor file system activity on PASOE servers for unauthorized file creations in sensitive directories
• Implement web application firewall (WAF) rules to detect and block suspicious file upload requests targeting OpenEdge endpoints
• Review HTTP access logs for POST requests with unusual parameters or file extensions being uploaded
• Deploy endpoint detection and response (EDR) solutions to identify malicious file writes and subsequent execution attempts

Monitoring Recommendations

• Enable detailed logging for PASOE WEB transport requests and file operations
• Set up alerts for file creation events in application server directories outside of scheduled deployment windows
• Monitor for process execution originating from uploaded files in server directories
• Implement integrity monitoring on critical PASOE installation directories to detect unauthorized modifications

How to Mitigate CVE-2023-40051

Immediate Actions Required

• Upgrade Progress OpenEdge to version 11.7.18 or later for the 11.7.x branch
• Upgrade Progress OpenEdge to version 12.2.13 or later for the 12.2.x branch
• Upgrade Progress OpenEdge Innovation releases to version 12.8.0 or later
• Review PASOE server directories for any unauthorized or suspicious files that may have been uploaded prior to patching

Patch Information

Progress has released security patches addressing this vulnerability. Detailed information about the patches and upgrade procedures is available in the Progress Security Alert: File Upload Vulnerability. Organizations should prioritize applying these updates given the critical severity of this vulnerability.

Workarounds

• Restrict network access to PASOE WEB transport endpoints using firewall rules to limit exposure to trusted networks only
• Implement additional authentication requirements for file upload functionality if possible
• Deploy a web application firewall (WAF) in front of PASOE to filter malicious upload requests
• Consider disabling unused WEB transport features until patches can be applied
• Implement strict file system permissions on server directories to limit the impact of unauthorized uploads

# Example: Restrict network access to PASOE port (adjust port number as needed)
# Linux iptables example - allow only trusted network
iptables -A INPUT -p tcp --dport 8810 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8810 -j DROP