Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-33498

CVE-2023-33498: alist Incorrect Access Control vulnerability

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-33498
GHSA ID
GHSA-hh54-53m7-7ffj
EPSS Score
0.29759%
CWE
CWE-434
Published
6/7/2023
Updated
11/10/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/alist-org/alist/v3go<= 3.16.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability description indicates improper access control in file upload functionality. While no specific code is shown, Go web applications typically handle uploads via controller functions. The combination of CWE-434 (unrestricted file upload) and the access control failure strongly suggests the upload handler function lacks: 1) Proper authorization checks verifying user privileges before accepting uploads, and 2) File type validation logic. The 'api' package and 'controllers' directory are common patterns for request handlers in Go web applications, making this the most likely location for the vulnerable upload processing logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*list <=*.**.* is vuln*r**l* to In*orr**t ****ss *ontrol. Low privil*** ***ounts **n uplo** *ny *il*.

Reasoning

T** vuln*r**ility **s*ription in*i**t*s improp*r ****ss *ontrol in *il* uplo** *un*tion*lity. W*il* no sp**i*i* *o** is s*own, *o w** *ppli**tions typi**lly **n*l* uplo**s vi* *ontroll*r *un*tions. T** *om*in*tion o* *W*-*** (unr*stri*t** *il* uplo**