Vulnerability record · CVE-2023-31465 · published 26 July 2023
CVE-2023-31465: FSMLabs TimeKeeper getsamplebacklog parameter command injection
Fsmlabs · Timekeeper
FSMLabs TimeKeeper 8.0.17 through 8.0.28 passes query parameters named arg[x] directly in the URL to the getsamplebacklog call. Modifying arg[2] allows an attacker to insert Bash code that the server executes. This is a remotely reachable command injection flaw in a time synchronization product.
Description
An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call. Some query parameters are passed directly in the URL and named arg[x], with x an integer starting from 1; it is possible to modify arg[2] to insert Bash code that will be executed directly by the server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network reachability, no authentication, and a public exploit makes this a critical remote code execution risk.
What it is
FSMLabs TimeKeeper 8.0.17 through 8.0.28 passes query parameters named arg[x] directly in the URL to the getsamplebacklog call. Modifying arg[2] allows an attacker to insert Bash code that the server executes. This is a remotely reachable command injection flaw in a time synchronization product.
Impact
An attacker can execute arbitrary Bash commands on the TimeKeeper server, leading to full compromise of confidentiality, integrity and availability of the host and its data.
Attack surface
The flaw is reached over the network via HTTP requests to the getsamplebacklog endpoint, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
A public proof-of-concept exploit exists in the CapgeminiCisRedTeam disclosure repository, and EPSS shows a 30-day probability of 0.46304 (98.76th percentile). The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is documented.
What to do
- Upgrade TimeKeeper to a version later than 8.0.28 if available, or apply the vendor's fix from FSMLabs.
- Restrict network access to the getsamplebacklog endpoint to trusted management hosts only.
- Validate and sanitize all arg[x] query parameters before they reach the server.
- Monitor FSMLabs security advisories for an official patch and deployment guidance.
Detection
- Inspect web server and application logs for requests to getsamplebacklog containing arg[2] values with shell metacharacters.
- Alert on unexpected child processes or Bash executions spawned by the TimeKeeper service.
- Monitor outbound network connections from the TimeKeeper host for signs of post-exploitation activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://fsmlabs.com/fsmlabs-cybersecurity/ | Product |
| https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2023-31465.md | ExploitThird Party Advisory |
| https://fsmlabs.com/fsmlabs-cybersecurity/ | Product |
| https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2023-31465.md | ExploitThird Party Advisory |
Track CVE-2023-31465 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-31465), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
