CVE-2023-26047

CVE-2023-26047 describes a bypass vulnerability in teler-waf, a Go HTTP middleware designed to protect against web attacks. Specifically, versions prior to v0.2.0 are susceptible to Cross-Site Scripting (XSS) attacks when a crafted, case-sensitive hex entities payload containing special characters is used. This allows attackers to bypass teler-waf's threat rules and execute arbitrary JavaScript, potentially leading to sensitive data theft or browser compromise. The vulnerability has a CVSS score of 6.1 (Medium), indicating a network-based attack with low attack complexity, requiring user interaction, and resulting in low confidentiality and integrity impacts. While the EPSS score is very low, suggesting a low probability of exploitation, the FAUCET Risk Score is 30/100. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The CVE has also received minimal community discussion and media coverage, suggesting it is not widely known or actively targeted.