PT-2023-24355 · Wrangler · Wrangler

Mskowroncf + 1 · Published 2023-08-03 · Updated 2023-08-29 · CVE-2023-3348

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wrangler versions 3.1.0 and earlier, Wrangler versions 2.20.1 and earlier

Description The issue is related to a directory traversal vulnerability that occurs when running a local development server for Pages using the wrangler pages dev command. This vulnerability allows an attacker on the same network as the victim to connect to the local development server and access files outside of the development server directory.

Recommendations For Wrangler versions 3.1.0 and earlier, update to a version later than 3.1.0 to resolve the issue. For Wrangler versions 2.20.1 and earlier, update to a version later than 2.20.1 to resolve the issue. As a temporary workaround, consider restricting access to the local development server to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-3348

GHSA-8C93-4HCH-XGXP

Affected Products

Wrangler

References · 10

• https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-8c93-4hch-xgxp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3348 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3348 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8c93-4hch-xgxp · Vendor Advisory
• https://github.com/cloudflare/workers-sdk · Note
• https://github.com/cloudflare/workers-sdk/pull/3498 · Note
• https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%403.1.1 · Note
• https://github.com/cloudflare/workers-sdk/commit/fddffdf0c23d2ca56f2139a2c6bc278052594cba · Note
• https://developers.cloudflare.com/workers/wrangler · Note
• https://t.me/cibsecurity/67696 · Telegram Post