CVE-2023-42248

Executive Summary

CVE-2023-42248 is an arbitrary file write vulnerability in Selesta Visual Access Manager (VAM) versions prior to 4.42.2. An authenticated attacker can manipulate POST parameters submitted to the common/vam_Sql.php page to write files to arbitrary locations on the underlying VAM server, with the likely end goal of planting a web shell and achieving remote code execution. The vulnerability is currently unpatched per all tracked sources, has no public PoC or exploit code, and is not listed in the CISA KEV catalog; the EPSS probability-of-exploitation score is low (0.00357).

Technical Analysis

The NVD description is sparse but identifies a concrete and dangerous flaw class: arbitrary file write triggered by an authenticated attacker manipulating POST parameters of the page common/vam_Sql.php in Selesta Visual Access Manager (VAM) prior to version 4.42.2.

The endpoint name vam_Sql.php strongly indicates a server-side script that provides SQL-related functionality — a common pattern in management platforms is a "query console" or "database administration" page that executes SQL statements and optionally exports or writes results to disk. The vulnerability mechanism falls into the external control of file name or path class (CWE-73): one or more POST parameters control the destination file path, and the application fails to validate or constrain that path. An authenticated attacker can therefore redirect the file-write operation outside the intended application directory — for example, into the web root — and control the content of the written file as well, since the content is derived either from SQL query output or from attacker-supplied parameter values.

Key characteristics derived from the available data:

• Pre-authentication state: The attacker must already hold a valid authenticated session in the VAM web application. This reduces the exposure surface to authorized users, but the privilege boundary crossed is significant — an authenticated (potentially low-privileged) user can escalate to OS-level file write on the server.
• Transport/vector: The manipulation is performed via HTTP POST parameters. The attack is therefore network-deliverable against the web interface and is likely to appear in web server access logs, HTTP proxy logs, and web application firewall (WAF) telemetry.
• Fix boundary: The NVD description identifies version 4.42.2 as the first non-affected version. No vendor advisory, patch commit, or changelog entry is present in any tracked source (patch confidence 0/4), which means patch availability cannot be independently confirmed.

Important limitation: the published description does not disclose the exact parameter names, the content-injection mechanism, or whether the written file content is fully attacker-controlled or solely derived from SQL query results. Insufficient technical detail is available to describe these specifics with confidence. The analysis above is at the vulnerability-class level and is consistent with the NVD description; analysts should not assume specific parameter names for detection purposes.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (authenticated arbitrary file write via POST parameter manipulation) and from the one disclosed endpoint path, common/vam_Sql.php. Implementation details that are not present in the NVD description are intentionally not fabricated.

1) Reconnaissance / target identification

• An attacker enumerates internet-exposed or internal Selesta VAM instances using web fingerprinting (title, login page, or product-specific HTML markers, e.g., http.title:"Visual Access Manager").
• The attacker then identifies the victim organization's VAM users. Because the flaw requires authentication, the attacker must either possess valid credentials, obtain them via phishing or credential stuffing, or leverage default/weak credentials on accounts provisioned for the VAM platform.

2) Triggering the flaw

• With a valid session, the attacker sends a crafted HTTP POST request to the common/vam_Sql.php page.
• The request manipulates the POST parameters that drive the server-side file-write operation. At the vulnerability-class level, the attacker targets a file path parameter by injecting traversal sequences (e.g., ../ or encoded variants) or an absolute path in order to redirect the write outside the intended directory.
• The target location is typically a directory from which the web server serves executable scripts (the web root) so that the written file can be subsequently requested over HTTP.

3) Payload / execution method (vulnerability-class level)

• The attacker causes the page to write a file containing script content — e.g., a PHP, JSP, or ASP web shell — into the web root or another reachable directory. The file content is either fully supplied through POST parameters or influenced by SQL query output under the attacker's control.
• The written file is then requested via a normal HTTP GET, causing the web server to interpret and execute its contents, which yields remote code execution with the privileges of the web server process.

4) Post-exploitation impact

• The attacker achieves remote code execution on the VAM host, allowing arbitrary command execution, credential harvesting from application configuration files and databases, and persistence via the planted web shell.
• From the compromised VAM server, the attacker can attempt lateral movement into the broader corporate network. If VAM is used to manage facility access or visual surveillance, the attacker may also gain insight into or tamper with physical security workflows — an outcome that goes beyond typical IT-focused incidents.

Impact Assessment

• Confidentiality / Integrity / Availability: Arbitrary file write allows the integrity of the application and host to be subverted (web shells, tampered scripts, overwritten configuration files). When combined with web-shell execution, confidentiality and availability are also impacted: the server is fully compromised, and SSRF-style or internal-network capabilities of the host can be used as a pivot.
• Affected systems: All Selesta VAM deployments running versions prior to 4.42.2. The affected versions list is empty in the available data; the only safe interpretation is "all installations below 4.42.2."
• Blast radius: The VAM platform is a web-based management application; in typical enterprise deployments, the server running it has access to application databases, LDAP/Active Directory, and the physical or video access control infrastructure. Compromise of this server therefore carries an elevated risk relative to a generic web application.
• CVSS: No official CVSS score or vector has been published by NVD or the CNA, so a standardized severity reference is unavailable. Given the class of vulnerability (authenticated arbitrary file write that typically escalates to RCE), the issue would likely rate High or Critical under CVSSv3.1 if scored.
• Exploit likelihood: EPSS score is 0.00357 (28.9th percentile), indicating a low probability of exploitation in the wild in the near term. The CVE is not present in the CISA Known Exploited Vulnerabilities catalog, and no exploit code, Nuclei template, or threat-actor campaign referencing this CVE was identified in the provided data.

Detection Guidance

Sigma Rule

Detects HTTP POST requests to the disclosed vulnerable endpoint with payload indicators consistent with path traversal or file-write / web-shell delivery attempts. Assumes a web server access log source.

title: Selesta VAM Arbitrary File Write Attempt via common/vam_Sql.php
id: 2f8c61a4-8d3a-4e5b-9a1c-6b0f3d2e7a11
status: experimental
description: Detects POST requests to common/vam_Sql.php containing path traversal or script-extension indicators, matching CVE-2023-42248 exploitation attempts.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-42248
author: Valtersit Threat Intelligence
date: 2025/04/24
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: POST
        cs-uri-path|contains:
            - /common/vam_Sql.php
            - /common/vam_sql.php
    selection_payload:
        cs-uri-query|contains:
            - '..%2f'
            - '..%5c'
            - '..%252f'
            - 'base64'
        cs-uri-query|re: '(\.php|\.jsp|\.asp|\.aspx|\.phtml)\b'
    condition: selection and selection_payload
    timeframe: 5m
fields:
    - c-ip
    - cs-username
    - cs-uri-stem
    - cs-uri-query
    - sc-status
falsepositives:
    - Legitimate administrative use of the SQL export/import feature with filenames containing the word 'php' (rare; tune regex).
level: high
tags:
    - attack.persistence
    - attack.t1505.003

YARA Rule

Scans captured HTTP request bodies/logs or files written to disk for markers of CVE-2023-42248 exploitation — the vulnerable endpoint path combined with traversal or script-payload strings.

rule CVE_2023_42248_Selesta_VAM_Arbitrary_File_Write
{
    meta:
        author      = "Valtersit Threat Intelligence"
        description = "Detects artifacts and HTTP captures referencing common/vam_Sql.php with path traversal or web shell payload indicators (CVE-2023-42248)"
        cve         = "CVE-2023-42248"
        date        = "2025-04-24"
        score       = 70

    strings:
        $s_endpoint  = "common/vam_Sql.php" ascii wide nocase
        $s_post      = "POST" ascii wide nocase
        $p_trav1     = "..%2f" ascii wide nocase
        $p_trav2     = "..%5c" ascii wide nocase
        $p_trav3     = "../" ascii
        $p_shell1    = "base64_decode" ascii wide nocase
        $p_shell2    = "eval(" ascii wide nocase
        $p_shell3    = "system(" ascii wide nocase
        $p_ext       = ".php" ascii wide nocase
        $p_upload    = "move_uploaded_file" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or filesize < 1MB
        and any of ($s*)
        and 2 of ($p*)
}

Suricata IDS Rule

Network-level detection for inbound POST requests to the vulnerable page carrying traversal or script-execution indicators.

alert http any any -> $HOME_NET any (msg:"CVE-2023-42248 Selesta VAM arbitrary file write attempt via common/vam_Sql.php"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/common/vam_Sql.php"; nocase; http.uri; clean; pcre:"/(?:\.\.(?:%2f|%5c|%252f)|\.(?:php|jsp|asp|aspx|phtml)\b|base64_decode)/i"; http.response_body; content:"HTTP"; sid:202342248; rev:1; classtype:attempted-admin; reference:cve,2023-42248;)

Note: http.uri; clean; is used to force the pcre to re-evaluate the full normalized URI; if your Suricata version does not support clean, remove the clean modifier and adjust the pattern accordingly. Tune the rule to your environment's legitimate use of the SQL page to avoid false positives.

Elastic Detection

EQL detection over file-creation events on the VAM host, focusing on script-extension files written by the web server process (typical result of an arbitrary file write attack).

file where event.action in ("creation", "overwrite", "write") and
  file.extension in ("php", "jsp", "asp", "aspx", "jspx", "phtml", "sh") and
  file.path like "*vam*" and
  process.name in ("php.exe", "php-cgi.exe", "httpd.exe", "nginx.exe", "apache2", "httpd", "nginx", "tomcat")

Additional EQL — web access log anomaly:

any where event.category == "web" and
  http.request.method == "POST" and
  wildcard(url.path, "*/common/vam_Sql.php", "*/common/vam_sql.php") and
  (url.query like "*..*" or url.query like "*.php*" or url.query like "*base64*")

Splunk SPL Query

Search web access logs for POST activity against the vulnerable endpoint, then enrich with client and user context:

index=* sourcetype=access_combined
method=POST uri_path=*/common/vam_Sql.php
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri_path, uri_query, status
| where count > 1
| table first_seen last_seen src_ip user uri_path uri_query status count

Search Windows file-creation events on the VAM server for web-shell-style files:

index=windows EventCode=11 TargetFilename=*vam*
| search TargetFilename=*.php OR TargetFilename=*.jsp OR TargetFilename=*.asp
| stats count by Image, TargetFilename, _time
| sort - _time

Wazuh OSSEC Rule

Wazuh rule matching Apache/Nginx access log decoder output for the vulnerable endpoint with suspicious query strings. Adjust the decoder (Apache is 31100) to match your log source.

<group name="web,selesta,cve,">
  <rule id="100422" level="12">
    <if_sid>31100</if_sid>
    <regex>POST /common/vam_Sql\.php</regex>
    <description>Selesta VAM: POST request to common/vam_Sql.php - possible CVE-2023-42248 arbitrary file write attempt</description>
    <field name="url">\.\.|base64|\.php|\.jsp|\.asp</field>
    <mitre>
      <id>T1505.003</id>
    </mitre>
    <group>web_application_attack,pci_dss_6.5,gpg13_10.1,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch status: Patch confidence is 0/4 — the vulnerability is UNPATCHED in all tracked sources. No vendor advisory, CVE patch commit, or release note is available. The only fix boundary suggested by the NVD description is version 4.42.2; organizations must treat any version below that as vulnerable until the vendor publishes a confirmed release.

1) Immediate mitigations (do these first):

• Restrict network access to the VAM web interface. Do not expose common/vam_Sql.php (or the entire administrative interface) to the internet or untrusted networks; enforce access via VPN or jump host with source-IP allowlists.
• Deploy a WAF rule that blocks or flags HTTP POST requests to /common/vam_Sql.php containing path traversal sequences, script extensions, or encoded payloads; at minimum, log and alert on such requests.
• Enforce multi-factor authentication (MFA) for all VAM accounts — the flaw requires a valid authenticated session, so strong authentication raises the bar for reaching the vulnerable code path.
• Review and reduce active VAM accounts; remove unused accounts and enforce least-privilege role assignments.

2) Patch / upgrade steps:

• Track the vendor's release channel for a patched build containing the fix for this CVE. When 4.42.2 or later is confirmed by the vendor, upgrade in a maintenance window after testing the update in a staging environment.
• Until then, if the SQL management functionality is not business-critical, consider disabling or removing the common/vam_Sql.php page entirely.

3) Long-term hardening:

• Implement file integrity monitoring (FIM) on the VAM web root and configuration directories to detect unauthorized file creation or modification.
• Harden the web server file system: run the web process with a dedicated low-privileged service account, and restrict write access to the web root to prevent script execution from writable directories.
• Enforce output encoding / server-side input validation for all paths and filenames passed to filesystem operations; the vendor should adopt a strict allowlist of writable directories and safe filenames.
• Monitor exploit-probability feeds (EPSS, CISA KEV) for changes in status, and maintain a watch on threat intelligence sources for any in-the-wild exploitation of this CVE.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-42248
2. MITRE CVE List: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42248
3. CVE JSON / CVE Services API (CNA record): https://cveawg.mitre.org/api/cve/CVE-2023-42248
4. CISA Known Exploited Vulnerabilities Catalog (verified: CVE-2023-42248 is not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS (CVE lookup): https://www.first.org/epss/api (query: CVE-2023-42248)

No vendor advisory, researcher blog, or threat-actor campaign referencing CVE-2023-42248 was identified at the time of writing. No evidence of exploitation in the wild was found. Analysts should re-validate the vendor advisory and patch availability before changing their risk posture.