Ziahamza webui-aria2: Local file inclusion (CVE-2023-39141)

CVE-2023-39141 is a high-severity local file inclusion (LFI) vulnerability affecting Ziahamza webui-aria2. An attacker can exploit this vulnerability without authentication or user interaction to read files from the host filesystem. A proof-of-concept tool has been published, enabling automated file enumeration. All versions of webui-aria2 are currently identified as affected.

Impact

Successful exploitation results in unauthorized disclosure of sensitive files residing on the host system. This may include configuration files, credentials, or system information, depending on the service account privileges under which the webui-aria2 process is running.

Recommendation

• Identify and inventory all instances of Ziahamza webui-aria2 within the environment.
• Restrict network access to webui-aria2 instances, ensuring they are not exposed to the public internet.
• Monitor web server logs for requests containing directory traversal patterns (e.g., ../) or suspicious file path enumeration attempts targeting webui-aria2 endpoints.
• Review the referenced GitHub Gist to understand the exploitation path and validate if internal WAF or IDS signatures can detect the documented exploit patterns.