CVE-2023-50094

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

13.54% chance of exploitation in the next 30 days, 96th percentile

Nuclei

high · CWE-78

Published

2024-01-01

Updated

2025-04-17

Proof-of-concept exploits (2)

• https://www.mattz.io/posts/cve-2023-50094/
• Zierax/CVE-2023-50094_POC1★ · 2024-11-23

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50094.yaml

Security advisories

• https://www.mattz.io/posts/cve-2023-50094
• yogeshojha/rengine/blob/5e120bd5f9dfbd1da82a193e8c9702e483d38d22/web/api/views.py#L195

References

• CVE Record
• NVD entry

Related

• CVE-2018-13379