CVE-2023-40050 — Automate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application

Description (CNA)

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution.

Affected (CNA)

Vendor / product	Versions
Progress Software Corporation / Chef Automate	affected 4.0.0 through 4.10.29

CWE

CWE-94, CWE-434

References

https://docs.chef.io/release_notes_automate/
https://docs.chef.io/automate/profiles/
https://community.progress.com/s/article/Product-Alert-Bulletin-October-2023-CHEF-Automate-CVE-2023-40050

ADP enrichment

CVE

No English description supplied.

https://docs.chef.io/release_notes_automate/
https://docs.chef.io/automate/profiles/
https://community.progress.com/s/article/Product-Alert-Bulletin-October-2023-CHEF-Automate-CVE-2023-40050

CISA-ADP

No English description supplied.

No references supplied.