medium

Super FabriXss

Published Tue, Mar 14th, 2023

Platforms

azure

Summary

Azure Service Fabric Explorer (SFX) was affected by an XSS vulnerability that could have allowed a malicious script to be reflected off a web application. After a potential victim clicked on a crafted malicious URL, the attacker could remotely toggle the ‘Cluster’ Event Type setting under the Events tab. This could lead to unauthenticated remote code execution on a container hosted on a Service Fabric node.

Affected Services

Azure Service Fabric Explorer (SFX)

Remediation

None required

Tracked CVEs

CVE-2023-23383

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23383https://orca.security/resources/blog/super-fabrixss-azure-vulnerability/

Contributed by https://github.com/mer-b

Entry Status

Finalized

Disclosure Date

Tue, Dec 20th, 2022

Exploitability Period

-

Known ITW Exploitation

-

Detection Methods

None

Piercing Index Rating

-

Discovered by

Lidor Ben Shitrit, Orca Security

More vulnerabilities...

medium

Imposter commits vulnerability in GitHub Actions

github

A vulnerability in GitHub Actions allows bypassing workflow settings using commits from forked repositories (rather than commits of the main action repo). This "imposter commits" issue can potentia...

Billy Lynch, Chainguard
high

Unauthorized access to Codespace secrets in GitHub

github

A vulnerability in GitHub's Repository Security Advisory feature allowed unauthorized users to access plaintext Codespace secrets of any organization, including GitHub itself. The issue stemmed fro...

Rojan Rijal, Ophion Security
medium

Overprivileged CodeBuild default ECR IAM policy

aws

For AWS CodeBuild, when using a custom container image stored in ECR and the project service role for the credentials to pull the image, the default IAM policy attached to the role to allow pulli...

Will Deane, ASX Consulting
View all