CVE-2023-1250

What it actually does

Improper input validation in ACL modules allows injection of executable code via manipulated comments and ACL names, resulting in local code execution.

Why it matters to the business

Attackers with local access can run arbitrary code on affected OTRS systems, risking full server compromise and disruption of service desk operations; high ecosystem prevalence increases exposure for organizations using these versions.

How an attack unfolds

An attacker with local access creates or imports an ACL containing injected code hidden in comments or ACL names; the code executes upon processing, enabling arbitrary command execution on the system.

How to fix it

Upgrade OTRS to 7.0.42 or later, 8.0.31 or later; upgrade Community Edition to 6.0.35 or later. Apply the listed fixed versions for chromium on Debian 11 where applicable.

How to confirm the fix worked

Verify installed OTRS version is at or above the fixed releases; test ACL import/create functions with sample inputs to confirm code execution is blocked.

Typical attack path

1. Gain local user access to the OTRS host
2. Create or import a malicious ACL
3. Embed executable code in comments or ACL name fields
4. Trigger ACL processing to execute the injected code

How to detect it

Review OTRS application logs and ACL import histories for unusual ACL names or comments; inspect process execution logs around ACL processing times for unexpected binaries.

What your security team should do

• Prioritize patching to fixed versions immediately given 1306 days since publication
• Audit existing ACLs for suspicious comments or names
• Restrict local access to OTRS servers
• Monitor EPSS trend and watch for emerging exploits