PT-2023-28881 · Croc · Croc

Matthias Gerstner · Published 2023-09-19 · Updated 2024-08-21 · CVE-2023-43620

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Croc versions prior to 9.6.16

Description An issue was discovered in Croc where a sender may place ANSI or CSI escape sequences in a filename to attack the terminal device of a receiver. This allows the sender to potentially exploit the receiver's terminal device.

Recommendations For Croc versions prior to 9.6.16, update to version 9.6.16 or later to resolve the issue. As a temporary workaround, consider validating and sanitizing filenames received from senders to prevent the inclusion of ANSI or CSI escape sequences. Restrict access to sensitive terminal devices to minimize the risk of exploitation.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2023-43620

GHSA-364C-VVQX-446C

GO-2023-2068

Affected Products

Croc

References · 16

• 🔥 https://github.com/schollz/croc/issues/595 · Exploit
• 🔥 https://openwall.com/lists/oss-security/2023/09/08/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-43620 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43620 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-2068 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-364c-vvqx-446c · Vendor Advisory
• https://github.com/schollz/croc · Note
• https://github.com/schollz/croc/pull/697 · Note
• https://github.com/schollz/croc/commit/3f12f75fae2e844c555ec01eeba0b8474938e93a · Note
• https://t.me/cibsecurity/70776 · Telegram Post
• https://github.com/advisories/GHSA-364c-vvqx-446c · Note
• https://twitter.com/CVEnew/status/1704373077721719179 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1704448528108466647 · Twitter Post
• http://openwall.com/lists/oss-security/2023/09/21/5 · Note
• https://t.me/cvenotify/58134 · Telegram Post