PT-2023-29855 · Sbt+1 · Sbt+1

Xuwei-K · Published 2023-10-23 · Updated 2024-11-15 · CVE-2023-46122

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Low

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions sbt versions prior to 1.9.7

Description The issue allows writing of arbitrary files given a specially crafted zip or JAR file, utilizing IO.unzip. This could potentially overwrite /root/.ssh/authorized keys. Within sbt's main code, IO.unzip is used in the pullRemoteCache task and Resolvers.remote. Many projects also use IO.unzip(...) directly for custom tasks.

Recommendations For versions prior to 1.9.7, update to version 1.9.7 to resolve the issue. As a temporary workaround, consider using an alternative library to unzip files until the update can be applied. Restrict access to the IO.unzip function to minimize the risk of exploitation. Avoid using IO.unzip directly in custom tasks until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-46122

GHSA-H9MW-GRGX-2FHF

OESA-2024-2422

OPENSUSE-SU-2023_4527-1

SUSE-SU-2023:4527-1

SUSE-SU-2023_4527-1

Affected Products

Suse

Sbt

References · 18

• 🔥 https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46122.json · Exploit
• https://github.com/sbt/io/issues/358 · Patch
• https://github.com/sbt/io/pull/360 · Patch
• https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-46122 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:4527-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2422 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h9mw-grgx-2fhf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-46122 · Vendor Advisory
• https://github.com/sbt/sbt · Note
• https://suse.com/support/update/announcement/2023/suse-su-20234527-1 · Note
• https://twitter.com/VulmonFeeds/status/1716523182318899478 · Twitter Post
• https://suse.com/security/cve/CVE-2023-46122 · Note
• https://twitter.com/CVEnew/status/1716489424974819764 · Twitter Post