CVE-2023-1783

Executive Summary

CVE-2023-1783 is a server-side information disclosure vulnerability affecting OrangeScrum version 2.0.11, an open-source project management platform. The flaw allows an external, unauthenticated attacker to remotely exfiltrate AWS instance credentials by abusing the application's PDF rendering functionality. The root cause is insufficient validation of HTML content submitted for PDF conversion, which permits server-side file reads or SSRF-style access to cloud metadata endpoints. With a CVSS score of 6.5 (Medium severity) and an EPSS percentile of 44.6%, the vulnerability presents a moderate but realistic exploitation risk. Critically, patch confidence is 0/4 — no vendor fix has been identified, leaving all deployments of OrangeScrum 2.0.11 exposed.

Technical Analysis

The vulnerability resides in OrangeScrum's PDF generation module. The application accepts user-supplied HTML input, which is subsequently processed and rendered into a PDF document. According to the NVD description, "the application does not properly validate the HTML content to be converted to PDF." This lack of input validation enables an attacker to inject server-side directives or external resource references within the HTML payload, which are then processed by the PDF rendering engine.

The specific attack mechanism falls into the general class of Server-Side PDF Generation Injection (sometimes referred to as HTML-to-PDF injection). When a server-side HTML-to-PDF converter processes unvalidated input, it typically interprets embedded markup such as <iframe>, <img>, <link>, or <script> tags, and may resolve file paths or URLs during the rendering process. Common exploitation techniques include:

• File read via <iframe> or <img>: Embedding local file paths (e.g., /etc/passwd) causes the renderer to fetch and embed the file contents into the generated PDF.
• SSRF via external URLs: Embedding HTTP URLs to internal endpoints (e.g., cloud metadata services) causes the server to fetch those resources and include them in the PDF. For AWS, the instance metadata endpoint at 169.254.169.254 exposes IAM role credentials when queried via http://169.254.169.254/latest/meta-data/iam/security-credentials/.

The NVD description explicitly states the outcome: "an external attacker to remotely obtain AWS instance credentials." This confirms that the PDF renderer is running on the same host as the OrangeScrum instance, and that the attacker can induce the server to query the AWS metadata service and reflect the response (the credentials JSON) inside the generated PDF, which is then retrievable by the attacker.

The attack surface is the PDF export feature, accessible remotely without authentication ("external attacker"). No specific function names, file paths, or API endpoints are disclosed in the CVE data, so implementation-level details are unavailable. The vulnerability is confirmed to affect OrangeScrum 2.0.11 specifically, but the lack of version range data and patch information suggests the issue may persist in later releases.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and NVD description.

Step 1 — Reconnaissance / Target Identification:
The attacker identifies an externally reachable OrangeScrum 2.0.11 instance. Reconnaissance typically involves scanning for the application's login portal or public-facing features, then locating the PDF export/report generation functionality. Shodan queries such as "OrangeScrum" or "Powered by OrangeScrum" may reveal exposed instances.

Step 2 — Triggering the Flaw:
The attacker crafts an HTML payload designed to bypass input validation. Since the application fails to sanitize HTML content destined for PDF conversion, the payload includes a directive that instructs the PDF renderer to fetch a resource from the internal network. The attacker submits this payload through the PDF generation interface.

Step 3 — Payload / Execution Method:
At the vulnerability-class level, the payload contains an embedded resource reference such as an <iframe> or <img> tag pointing to http://169.254.169.254/latest/meta-data/iam/security-credentials/. When the renderer processes the HTML, it makes an outbound HTTP request to the AWS metadata service. The response — the IAM role name — is embedded into the PDF. A second request adds the role name path to retrieve the full credentials JSON (AccessKeyId, SecretAccessKey, Token).

Step 4 — Post-Exploitation Impact:
The attacker downloads the generated PDF, extracts the embedded AWS credentials, and uses them to authenticate against AWS APIs. Depending on the IAM role's permissions, this can lead to unauthorized access to S3 buckets, EC2 instances, databases, or other cloud resources. Since the credentials are temporary role credentials, the attacker must operate within the token's validity window but can potentially escalate privileges by leveraging the compromised role.

Impact Assessment

• Confidentiality Impact: High — attacker obtains valid AWS credentials, exposing any data or resources the IAM role can access.
• Integrity Impact: Low-to-Medium — compromised credentials may allow modification of cloud resources.
• Availability Impact: Low — no direct DoS mechanism in the vulnerability itself.
• Attack Vector: Network (remote, no authentication required per NVD description).
• Attack Complexity: Low — the HTTP request to the metadata service is straightforward; no specialized tools beyond an HTML-capable client.
• Affected Systems: Any OrangeScrum 2.0.11 deployment hosted on AWS EC2 (or similar) with an IAM role attached, running the vulnerable PDF rendering module.
• Blast Radius: Cloud environment compromise. If the IAM role is overly permissive (e.g., broad S3 access or admin rights), the impact extends well beyond the OrangeScrum instance itself.

The CVSS score of 6.5 (Medium) reflects the high confidentiality impact but medium scope due to the conditional requirement of the host being on AWS with IAM roles.

Detection Guidance

Detection focuses on anomalous outbound requests from the application server to the cloud metadata service (169.254.169.254) and on suspicious HTML payloads submitted to PDF generation endpoints. The rules below are illustrative and may require adaptation to your environment.

Sigma Rule

title: Suspicious HTML to PDF Request Targeting AWS Metadata
id: 9f7b3c2a-1d6e-4a8b-9c5d-2f1a3b4c5d6e
status: experimental
description: Detects HTML-to-PDF requests containing references to AWS instance metadata service (169.254.169.254)
logsource:
  category: webserver
  product: apache
  service: accesslog
detection:
  selection:
    cs-method: 'GET|POST'
    cs-uri-query|contains:
      - 'iframe'
      - 'img'
      - 'src='
    cs-uri-query|contains|any:
      - '169.254.169.254'
      - 'instance-data'
      - 'latest/meta-data'
  condition: selection
level: high
falsepositives:
  - Legitimate monitoring tools checking metadata service
tags:
  - attack.t1190
  - attack.t1005
  - cve.2023.1783

YARA Rule

rule CVE_2023_1783_OrangeScrum_PDF_Injection
{
    meta:
        author = "ValterSIT Threat Intel"
        description = "Detects payloads targeting OrangeScrum PDF rendering to leak AWS credentials"
        cve = "CVE-2023-1783"
        date = "2024-01-01"
    strings:
        $metadata1 = "169.254.169.254" ascii nocase
        $metadata2 = "latest/meta-data/iam/security-credentials" ascii nocase
        $metadata3 = "instance-data" ascii nocase
        $html_tag1 = "<iframe" ascii nocase
        $html_tag2 = "<img" ascii nocase
        $html_tag3 = "src=" ascii nocase
        $pdf_marker = "%PDF" ascii
    condition:
        filesize < 2MB and
        ($metadata1 or $metadata2 or $metadata3) and
        ($html_tag1 or $html_tag2 or $html_tag3)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2023-1783 OrangeScrum PDF Injection - AWS Metadata Access"; flow:established,to_server; content:"169.254.169.254"; http_uri; nocase; content:"latest/meta-data"; http_uri; nocase; reference:cve,2023-1783; classtype:attempted-info-leak; sid:10000012; rev:1;)

Elastic Detection

any where process.name == "java" or process.name == "node" or process.name == "chrome" or process.name == "wkhtmltopdf"
// Adjust based on PDF rendering engine used by OrangeScrum
  and network.protocol == "http"
  and url.domain == "169.254.169.254"
  or url.path contains "latest/meta-data"

Splunk SPL Query

index=web sourcetype=access_combined
| search uri=*169.254.169.254* OR uri=*latest/meta-data* OR uri=*instance-data*
| stats count by src_ip, uri, status
| where count > 0

Wazuh OSSEC Rule

<rule id="100283" level="12">
  <decoded>web-accesslog</decoded>
  <match>169.254.169.254</match>
  <regex>latest/meta-data</regex>
  <description>Possible CVE-2023-1783 exploitation: OrangeScrum HTML-to-PDF accessing AWS metadata</description>
  <group>cve-2023-1783,attack.t1190,</group>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor fix, advisory, or patched version has been identified from any tracked source. The following actions are recommended:

Immediate Mitigations (Compensating Controls)

1. Restrict network access to the cloud metadata service from the application server. Implement iptables or security group rules blocking outbound requests to 169.254.169.254 from the web application process, while allowing only trusted system services.
2. Disable or restrict the PDF export feature if it is not business-critical, or firewall it to authenticated administrators only.
3. Deploy a Web Application Firewall (WAF) rule to block requests to PDF generation endpoints containing references to 169.254.169.254, instance-data, or latest/meta-data in query parameters or POST bodies.
4. Harden the IAM role attached to the EC2 instance: remove unnecessary permissions, apply least-privilege principles, and rotate credentials immediately if exposure is suspected.

Patch / Upgrade Steps

• No official patch exists. Monitor OrangeScrum's official repository, release notes, and security advisories for an updated version addressing PDF input validation.
• If upgrading to a non-vulnerable version becomes available, do so immediately. Until then, compensate with the mitigations above.
• Consider replacing the PDF rendering component with a sandboxed, open-source alternative that sanitizes HTML input (e.g., a rendering service running in an isolated container without access to the metadata service).

Long-Term Hardening

1. Apply input validation and allowlist-based sanitization to all HTML content processed by server-side renderers. Disable external resource fetching in the PDF library configuration.
2. Run PDF rendering in an isolated microservice on a separate host without IAM roles or network access to cloud metadata.
3. Enable comprehensive logging of outbound requests from application servers and alert on any traffic to internal-only IP ranges.
4. Review and rotate AWS IAM credentials periodically; implement automated detection for unexpected use of role credentials.
5. Subscribe to CVE feeds and vendor security advisories to obtain immediate notification of a future patch.

References

1. NVD Entry — CVE-2023-1783: https://nvd.nist.gov/vuln/detail/CVE-2023-1783
2. OrangeScrum Official Site: https://www.orangescrum.com/ (monitor for security advisories)
3. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2023-1783 is NOT listed, confirming no known active exploitation as of this report)
4. OrangeScrum GitHub Repository (for patch monitoring): https://github.com/Orangescrum/orangescrum (returned 404 — verify manually)
5. AWS Documentation on Instance Metadata & IAM Roles: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html

Threat Actor Activity: No confirmed exploit-in-the-wild evidence or associated threat actor campaigns were identified in the provided data. The EPSS score of 0.00576 (44.6th percentile) indicates a moderate likelihood of exploitation relative to other CVEs, but absence from CISA KEV suggests exploitation is not yet widespread.