Please carefully read this notification. It provides a brief description of the security vulnerability, potential impact, important links to Update details and additional information.  

If you are using the WEB transport in PASOE, there is a security vulnerability. All OpenEdge releases are impacted up to and including OpenEdge 11.7.17, 12.2.12, 12.7. 
The recommended action from Progress is to upgrade your application to the latest version of an Active OpenEdge release and then apply the provided Updates as follows. 
 

Vulnerable Version	Fixed Version
OpenEdge Release 11.7.17 and earlier	OpenEdge LTS Update 11.7.18
OpenEdge Releases 12.2.12 and earlier	OpenEdge LTS Update 12.2.13
OpenEdge Innovation Release 12.7 and earlier	OpenEdge LTS Release 12.8.0

If you are running an OpenEdge version that is Retired as described in the OpenEdge Life Cycle, it is necessary to upgrade to one of the Active OpenEdge releases listed above.  

For users that cannot upgrade immediately, mitigating actions are described later in this document. These are recommended for short-term use and only for those who cannot apply the appropriate patch on supported releases at this time.  

 

Security Issue and Potential Impact: 

Please review the public information associated with this security vulnerability provided by the National Vulnerability Database located at CVE-2023-40051.  
 

The WEB transport in PASOE has support for file uploads across all web handlers and all web handlers are affected including the built-in handlers. The expected behavior is that file upload is disabled by default since the value for the “fileUploadDirectory” property in the openedge.properties file is blank. However, this default property setting allows access to all directories for the user account that started the PASOE instance. If these directories have write permission, the system running PASOE is vulnerable to a malicious file upload on the system (Linux) or on the root drive (Windows). An attacker with the unexpected ability to upload to the system running PASOE could then launch a wider scale attack. 
 

Business Impact: 

An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE.  If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible. 

 

Resolution: 

An Update is available in OpenEdge 11.7.18, 12.2.13 or 12.8.0. Click here for instructions on how to download your product software and license file. Customers who are not on a current Service Agreement should contact your OpenEdge account representative. 

Use the instructions here to view the version of OpenEdge running on your system. 

 

Temporary Mitigation Steps: 

If you cannot apply the provided product Update at this time, you can use the following steps to mitigate the vulnerability. This mitigation is recommended for short-term use until you can apply the provided OpenEdge Update to your application.  

• Set the configuration property “fileUploadDirectory” in the openedge.properties file to a non-existent directory and restart the instance. Instructions on editing properties can be found in Configure OpenEdge properties.  

fileUploadDirectory=${CATALINA_BASE}/work/doesnotexist 

 

If you have any questions, concerns, or problems related to this issue, please login to open a new Technical Support case here for assistance or reach out to your application provider. Technical Support is available to OpenEdge customers under warranty and an active Service Agreement. 

We want to stress that security is of the utmost importance to us. Progress leverages development practices to minimize product vulnerabilities and we take prompt action to notify you of potential risks. We sincerely apologize for any inconvenience this situation may cause you. 

 

Sincerely,  

The Progress OpenEdge Team