PT-2023-28881 · Croc · Croc
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Croc versions prior to 9.6.16
Description
An issue was discovered in Croc where a sender may place ANSI or CSI escape sequences in a filename to attack the terminal device of a receiver. This allows the sender to potentially exploit the receiver's terminal device.
Recommendations
For Croc versions prior to 9.6.16, update to version 9.6.16 or later to resolve the issue. As a temporary workaround, consider validating and sanitizing filenames received from senders to prevent the inclusion of ANSI or CSI escape sequences. Restrict access to sensitive terminal devices to minimize the risk of exploitation.
Exploit
Correção
Improper Encoding or Escaping of Output
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Croc