CVE-2023-0090CWE-95

Proofpoint Enterprise Protection webservices unauthenticated RCE

Critical · published March 8, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
54.2
In the wild
Unconfirmed
What it is

🚨 An anonymous user could remotely execute code just by reaching the webservices API! That’s like giving the keys to your server to a stranger if they just happen to knock on the right door. 🔥 Think of it like a hotel where anyone can walk in through the lobby and order room service without checking in first — wildly unsafe! This vulnerability opens the door for attackers to run any code they want without proper authentication. If exploited, an attacker could completely take over the webservices, siphoning sensitive data, altering configurations, or even deploying malware. The potential fallout could be absolutely devastating, leading to both data leaks and operational chaos for organizations relying on Proofpoint. It's a critical vulnerability that demands immediate attention!

Put simply

Think of it like a hotel where anyone can walk in through the lobby and order room service without checking in first — wildly unsafe! This vulnerability opens the door for attackers to run any code they want without proper authentication. CVE-2023-0090 allows for remote code execution via 'eval injection' in Proofpoint Enterprise Protection's webservices, which affects all versions up to 8.20.0. This means that an attacker with network access to a non-standard configuration can send malicious code that the server will execute without proper checks.

What to do

If exploited, an attacker could completely take over the webservices, siphoning sensitive data, altering configurations, or even deploying malware. The potential fallout could be absolutely devastating, leading to both data leaks and operational chaos for organizations relying on Proofpoint. It's a critical vulnerability that demands immediate attention! Update your Proofpoint Enterprise Protection to version 8.20.1 or later immediately to close this vulnerability. Additionally, verify your API configurations to ensure they comply with standard security practices, limiting network access where possible. You've got this! By taking these steps, you'll be well on your way to securing your systems and earning your superhero badge in cybersecurity! 🦸‍♂️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00744 · 54.2th percentile
Weakness
CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Published
2023-03-08T00:27Z
EPSS history
Timeline
  • 08 MAR 00:27Z
    Proofpoint Enterprise Protection webservices unauthenticated RCE
    cvelistv5