.. / CVE-2023-47117

• Info Disclosure
• Nuclei
• Web

Exploit for Label Studio - Sensitive Information Exposure (CVE-2023-47117)

Description:

An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on the platform by exploiting Django’s Object Relational Mapper (ORM). Since the results of query can be manipulated by the ORM filter, an attacker can leak these sensitive fields character by character.

Nuclei Template

View the template here CVE-2023-47117.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2023/CVE-2023-47117.yaml

References: