CVE-2023-2479

published 2023-05-02

CVE-2023-2479: OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.

Priority P2 73 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
appium	appium-desktop	< 1.22.3-4	1.22.3-4
appium	appium-desktop	0 – 1.14.1	—
appium	appium_appium-desktop	>= unspecified < v1.22.3-4	v1.22.3-4

Detection & IOCs extracted from sources · hover to see the quote

url {{BaseURL}}/?url=↗

• → Exploit targets the `url` query parameter via HTTP GET request to the root path; inject OS commands through this parameter to trigger RCE. ↗
• → Vulnerable endpoint responds with HTTP 404 and Content-Type: application/json; match response body for the specific error string to confirm exploitability. ↗
• → Confirm out-of-band DNS interaction (OAST/interactsh) to validate blind OS command injection execution on the target. ↗
• → Response header must contain 'application/json' as part of multi-condition matching to confirm the vulnerable Appium Desktop Server endpoint. ↗

• · Vulnerability affects only Appium Desktop versions prior to v1.22.3-4; patched in that release. ↗
• · Exploitation requires no authentication (PR:N, UI:N per CVSS), making all network-exposed instances immediately at risk. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78