{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/blogengine.net/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:blogengine:blogengine.net:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2023-33404"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["BlogEngine.NET (\u003c= 3.3.8.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["BlogEngine.NET"],"content_html":"\u003cp\u003eBlogEngine.NET versions 3.3.8.0 and earlier contain an arbitrary file upload vulnerability (CVE-2023-33404) that facilitates remote code execution. The vulnerability resides within the application's API processing logic, specifically the /api/upload endpoint. An attacker holding the 'EditOwnPosts' permission can abuse this endpoint to upload malicious files. The application fails to properly validate the file type or path, instead saving the uploaded content to a hard-coded directory. Once the file is placed in this directory, an attacker can access the file via a standard HTTP request to trigger execution of the embedded code. This vulnerability is significant due to the availability of proof-of-concept exploit material, which increases the likelihood of exploitation against unpatched instances.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the BlogEngine.NET instance with at least 'EditOwnPosts' privileges.\u003c/li\u003e\n\u003cli\u003eAttacker initiates an HTTP POST request to the /api/upload endpoint with the parameter \u0026quot;action=video\u0026quot;.\u003c/li\u003e\n\u003cli\u003eThe application verifies the user's 'EditOwnPosts' permissions.\u003c/li\u003e\n\u003cli\u003eThe application processes the request, utilizing the hard-coded directory path for storage.\u003c/li\u003e\n\u003cli\u003eThe server-side UploadVideo function is invoked to handle the incoming file stream.\u003c/li\u003e\n\u003cli\u003eThe application writes the malicious file to the filesystem, creating the target directory if it does not already exist.\u003c/li\u003e\n\u003cli\u003eAttacker makes a subsequent HTTP GET request to the path where the file was saved.\u003c/li\u003e\n\u003cli\u003eThe web server executes the code contained within the uploaded file, resulting in full remote code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated (post-authentication) attackers to gain remote code execution on the server hosting BlogEngine.NET. This grants the attacker the ability to interact with the underlying operating system, potentially leading to full system compromise, data exfiltration, or the deployment of additional malicious payloads.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eIdentify all instances of BlogEngine.NET running version 3.3.8.0 or earlier within the enterprise environment.\u003c/li\u003e\n\u003cli\u003eMonitor web access logs for POST requests to the /api/upload endpoint originating from user accounts with non-administrative, specific post-editing privileges.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule below to detect potential exploitation attempts targeting the file upload API.\u003c/li\u003e\n\u003cli\u003ePatch all BlogEngine.NET instances to a version later than 3.3.8.0 as soon as vendor updates become available.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-20T09:05:48Z","date_published":"2026-10-20T09:05:48Z","id":"https://feed.craftedsignal.io/briefs/2026-10-blogengine-rce/","summary":"BlogEngine.NET versions 3.3.8.0 and earlier are vulnerable to arbitrary file upload via the /api/upload endpoint, allowing authenticated users with EditOwnPosts permissions to achieve remote code execution.","title":"BlogEngine.NET: Arbitrary File Upload Remote Code Execution (CVE-2023-33404)","url":"https://feed.craftedsignal.io/briefs/2026-10-blogengine-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - BlogEngine.NET","version":"https://jsonfeed.org/version/1.1"}