CVE-2024-34060CWE-22

Arbitrary File Write in IRIS EVTX Pipeline

High · published May 23, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
62.7
In the wild
Unconfirmed
What it is

IrisEVTXModule is an interface module for Evtx2Splunk and Iris in order to ingest Microsoft EVTX log files. The `iris-evtx-module` is a pipeline plugin of `iris-web` that processes EVTX files through IRIS web application. During the upload of an EVTX through this pipeline, the filename is not safely handled and may cause an Arbitrary File Write. This can lead to a remote code execution (RCE) when combined with a Server Side Template Injection (SSTI). This vulnerability has been patched in version 1.0.0.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01005 · 62.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-05-23T12:01Z
EPSS history
Timeline
  • 23 MAY 12:01Z
    Arbitrary File Write in IRIS EVTX Pipeline
    cvelistv5