LG Simple Editor copySessionFolder Directory Traversal Remote Code Execution Vulnerability

The impact of CVE-2023-40493 is severe. Successful exploitation allows an attacker to execute arbitrary code with SYSTEM privileges, effectively granting them complete control over the affected machine. This could involve data theft, malware installation, or further lateral movement within the network. The lack of authentication requirements significantly lowers the barrier to entry for attackers, making this a high-priority vulnerability to address. The vulnerability's similarity to other directory traversal exploits suggests a potential for widespread exploitation if left unpatched.

Organizations utilizing LG Simple Editor, particularly those with older versions (3.21.0 and prior), are at significant risk. Environments with limited network segmentation or weak access controls are especially vulnerable, as an attacker can easily exploit this vulnerability to gain a foothold on the system. Shared hosting environments where multiple users share the same LG Simple Editor installation are also at increased risk.

• windows / supply-chain:

Get-Process -Name "LGSimpleEditor*" | Select-Object -ExpandProperty Path

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.TaskName -like "LGSimpleEditor*"}

• windows / supply-chain:

Get-WinEvent -LogName Application -Filter "EventID=1001 and Source='LG Simple Editor'" -MaxEvents 10

• generic web:

curl -I http://<target_ip>/copySessionFolder?path=../../../../Windows/System32/cmd.exe

1. 2024-05-03Disclosure

   disclosure

1. 予約済み2023-08-14
2. 公開日2024-05-03
3. 更新日2024-09-18
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2023-40493 is to upgrade to a patched version of LG Simple Editor as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds. Restrict network access to the LG Simple Editor installation to only authorized users. Implement strict file access controls to limit the attacker's ability to write to sensitive locations. Monitor system logs for suspicious activity related to file operations and process creation. While a WAF or proxy cannot directly prevent this vulnerability, it can help detect and block malicious requests attempting to exploit it. After upgrading, verify the fix by attempting to trigger the copySessionFolder command with a malicious path and confirming that it is properly sanitized.