PT-2023-28882 · Croc · Croc

Matthias Gerstner · Published 2023-09-19 · Updated 2024-08-21 · CVE-2023-43621

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Croc versions prior to 9.6.16

Description An issue was discovered in Croc where the shared secret, located on a command line, can be read by local users who list all processes and their arguments.

Recommendations For Croc versions prior to 9.6.16, update to version 9.6.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the command line arguments to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2023-43621

GHSA-7G3V-4GGR-XVJF

GO-2023-2069

Affected Products

Croc

References · 16

• 🔥 https://github.com/schollz/croc/issues/598 · Exploit
• 🔥 https://openwall.com/lists/oss-security/2023/09/08/2 · Exploit
• https://osv.dev/vulnerability/GHSA-7g3v-4ggr-xvjf · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-2069 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-43621 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43621 · Security Note
• https://github.com/schollz/croc · Note
• https://github.com/schollz/croc/commit/863dabb93a271f41b3431c4384357e1856a69533 · Note
• https://github.com/schollz/croc/pull/701 · Note
• https://t.me/cibsecurity/70783 · Telegram Post
• http://openwall.com/lists/oss-security/2023/09/21/5 · Note
• https://twitter.com/VulmonFeeds/status/1704447515813151140 · Twitter Post
• https://github.com/advisories/GHSA-7g3v-4ggr-xvjf · Note
• https://t.me/cvenotify/58359 · Telegram Post
• https://t.me/cvenotify/58133 · Telegram Post