PT-2023-28995 · Arduino · Arduino Create Agent

Giubby84 · Published 2023-10-18 · Updated 2023-11-02 · CVE-2023-43802

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Arduino Create Agent versions prior to 1.3.3

Description The issue affects the endpoint "/upload" which handles requests with the filename parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate their privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request.

Recommendations For versions prior to 1.3.3, upgrade to version 1.3.3 to resolve the issue. As a temporary workaround, consider restricting access to the "/upload" endpoint or disabling it until the upgrade is applied. Avoid using the filename parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-35

CWE-22

Related Identifiers

CVE-2023-43802

GHSA-75J7-W798-CWWX

Affected Products

Arduino Create Agent

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43802.json · Exploit
• https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-75j7-w798-cwwx · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-75j7-w798-cwwx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43802 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43802 · Vendor Advisory
• https://github.com/arduino/arduino-create-agent/releases/tag/1.3.3 · Note
• https://github.com/arduino/arduino-create-agent · Note
• https://twitter.com/CVEnew/status/1714746425899180226 · Twitter Post
• https://nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide · Note
• https://twitter.com/VulmonFeeds/status/1714769531040567719 · Twitter Post
• https://twitter.com/cracbot/status/1715064575970639964 · Twitter Post
• https://t.me/cibsecurity/72541 · Telegram Post