OpenProject < 12.5.4 - Project Identifiers Exposure

mediumseverity

5.3CVSS score

1.3%likelihood of exploitation, next 30 days

70%of all CVEs are less likely

Readycheck to confirm it

OpenProject versions before 12.5.6 generate a publicly accessible robots.txt file revealing project identifiers, even if the instance is set to 'Login required', letting attackers gather project info, exploit requires no authentication.

Impact

Attackers can enumerate project identifiers, potentially aiding targeted attacks or information gathering.

Fix

Upgrade to version 12.5.6 or later, or apply the provided patch to versions above 10.0.

How to confirm it

Send: GET {{BaseURL}}/robots.txt
Positive when: status_code == 200 and contains(body, "Disallow: /projects/") and contains_any(body, "/work_packages", "/repository", "/activity")

Run it with nuclei: nuclei -id CVE-2023-33960 -u <target>

The full check

id: CVE-2023-33960

info:
  name: OpenProject < 12.5.4 - Project Identifiers Exposure
  author: 0x_Akoko
  severity: medium
  description: |
    OpenProject versions before 12.5.6 generate a publicly accessible robots.txt file revealing project identifiers, even if the instance is set to 'Login required', letting attackers gather project info, exploit requires no authentication.
  impact: |
    Attackers can enumerate project identifiers, potentially aiding targeted attacks or information gathering.
  remediation: |
    Upgrade to version 12.5.6 or later, or apply the provided patch to versions above 10.0.
  reference:
    - https://www.openproject.org/docs/release-notes/12-5-4/
    - https://github.com/opf/openproject/security/advisories/GHSA-4r3x-x7xf-h2gc
    - https://nvd.nist.gov/vuln/detail/CVE-2023-33960
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-33960
    epss-score: 0.01257
    epss-percentile: 0.698
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"OpenProject"
  tags: cve,cve2023,openproject,exposure,api,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/robots.txt"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "Disallow: /projects/")'
          - 'contains_any(body, "/work_packages", "/repository", "/activity")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from