CVE-2023-4760
In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. The reason for this is a not completely secure extraction of the file name in the FileUploadProcessor.stripFileName(String name) method. As soon as this finds a / in the path, everything before it is removed, but potentially \ (backslashes) coming further back are kept. For example, a file name such as /..\..\webapps\shell.war can be used to upload a file to a Tomcat server under Windows, which is then saved as ..\..\webapps\shell.war in its webapps directory and can then be executed.
- Affected products
- Eclipse Rap, Apache Tomcat
- Eclipse Remote Application Platform
- ≤ 3.25.0
- CVSS 3.1
- 9.8 CRITICAL
- EPSS
- 1.0% (61th percentile)
- Weakness
- CWE-23, CWE-22
- NVD status
- Modified
- Published
- 2023-09-21
- Attack patterns
- CAPEC-154
No indexed exploits for CVE-2023-4760 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2023-4760 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.