CVE-2023-38060

What it actually does

Improper input validation on the ContentType parameter for attachments allows an authenticated attacker to inject arbitrary values into the ContentType header during TicketCreate or TicketUpdate operations via the Generic Interface.

Why it matters to the business

Attackers with valid credentials can manipulate attachment headers in a widely used enterprise ticketing platform, potentially enabling data exfiltration or unauthorized modifications that disrupt support workflows; low exploitation likelihood given stable low EPSS and absence from known exploited lists despite 1180 days since disclosure.

How an attack unfolds

An authenticated attacker sends a specially crafted request to the Generic Interface endpoints for TicketCreate or TicketUpdate, supplying a malicious ContentType value that results in host header injection for the attachment; no named threat actors or ransomware campaigns have been associated with this issue.

How to fix it

Upgrade OTRS to version 7.0.45 or later, 8.0.35 or later, or ((OTRS)) Community Edition to 6.0.35 or later; restrict Generic Interface access to trusted networks and authenticated users only until patches are applied.

How to confirm the fix worked

Verify installed version against the fixed releases listed in the advisory; attempt reproduction with a test request containing a non-standard ContentType value and confirm the header is no longer injectable.

Typical attack path

1. Obtain valid authentication credentials for an OTRS instance
2. Craft a request targeting the Generic Interface TicketCreate or TicketUpdate operation
3. Inject a malicious value into the ContentType parameter of an attachment
4. Observe or leverage the resulting host header injection

How to detect it

Inspect web server and application logs for Generic Interface requests containing unusual or malformed ContentType values on ticket creation or update operations; correlate with attachment processing events.

What your security team should do

• Prioritize upgrade of all affected OTRS deployments to the versions specified in the advisory
• Limit exposure of the Generic Interface to least-privilege authenticated accounts
• Review and tighten input validation rules for attachment handling if custom modules are present
• Monitor EPSS and KEV updates for any future increase in exploitation activity