Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-4570

CVE-2023-4570: NI MeasurementLink Python Services Improper Access Restriction vulnerability

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-4570
GHSA ID
GHSA-3f48-9j7q-q2gv
EPSS Score
0.3055%
CWE
CWE-420
Published
10/5/2023
Updated
11/9/2023
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
ni-measurementlink-servicepip< 1.1.11.1.1
ni-measurementlink-servicepip>= 1.2.0.dev0, < 1.2.01.2.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The critical vulnerability stemmed from binding the service to all network interfaces (IPv6 '::' wildcard) instead of loopback. The commit diff shows the fix explicitly sets host='[::1]' (IPv6 loopback) in service_manager.py's start method. This matches CWE-420 (Unprotected Alternate Channel) as it improperly exposed a communication channel thought to be restricted.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *n improp*r ****ss r*stri*tion in NI M**sur*m*ntLink Pyt*on s*rvi**s *oul* *llow *n *tt**k*r on *n **j***nt n*twork to r**** s*rvi**s *xpos** on lo**l*ost. T**s* s*rvi**s w*r* pr*viously t*ou**t to ** unr******l* outsi** o* t** no**. T*i

Reasoning

T** *riti**l vuln*r**ility st*mm** *rom *in*in* t** s*rvi** to *ll n*twork int*r****s (IPv* '::' wil***r*) inst*** o* loop***k. T** *ommit *i** s*ows t** *ix *xpli*itly s*ts *ost='[::*]' (IPv* loop***k) in s*rvi**_m*n***r.py's st*rt m*t*o*. T*is m*t*