CVE-2023-50094

published 2024-01-01

CVE-2023-50094: reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an…

Priority P2 75 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
yogeshojha	rengine	<= 2.0.2	—

Detection & IOCs extracted from sources · hover to see the quote

url api/tools/waf_detector/?url=↗

path /api/tools/waf_detector/↗

path /login

path /scan-engine/update

command {"nmap_cmd": 'curl {{interactsh-url}}'}

• → Monitor HTTP requests to /api/tools/waf_detector/ with shell metacharacters in the 'url' query parameter, as this is the injection point for CVE-2023-50094. ↗
• → Injected commands execute as root via subprocess.check_output; monitor for unexpected root-level process spawning from the reNgine web process. ↗
• → Exploitation requires a valid authenticated session; correlate suspicious WAF detector or scan-engine API calls with recently authenticated session IDs. ↗
• → Detect reNgine instances exposed to the internet using Shodan query title:"reNgine" to identify potentially vulnerable targets.

• · Exploitation requires a valid authenticated session (PR:L); unauthenticated attackers cannot directly exploit this vulnerability. ↗
• · EPSS score of 0.88564 (99.5th percentile) indicates very high likelihood of active exploitation in the wild; prioritize patching.

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78