CVE-2023-46117

    Dashboard / Vulnerabilities / CVE-2023-46117

    CVE-2023-46117

    Published: 20 Oct 2023Last Modified: 28 Oct 2026

    Summary: Inadequate validation of retrieved subdomains may lead to a Remote Code Execution in reconFTW

    Details: reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities. A vulnerability has been identified in reconftw where inadequate validation of retrieved subdomains may lead to a Remote Code Execution (RCE) attack. An attacker can exploit this vulnerability by crafting a malicious CSP entry on it's own domain. Successful exploitation can lead to the execution of arbitrary code within the context of the application, potentially compromising the system. This issue has been addressed in version 2.7.1.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46117.json, https://github.com/six2dez/reconftw/security/advisories/GHSA-fxwr-vr9x-wvjp, https://nvd.nist.gov/vuln/detail/CVE-2023-46117, https://github.com/six2dez/reconftw/commit/e639de356c0880fe5fe01a32de9d0c58afb5f086

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -90dacad7f46911c2f4af162df1d607c6ea8a3490

    Affected versions

    v2.7.1
    v2.7

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High