CVE-2023-43802: Path traversal in Arduino Create Agent
Impact The vulnerability affects the endpoint /upload which handles request with the filename parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. Further details are available in the references.
Fixed Version 1.3.3
References The issue was reported by Nozomi Networks Labs. Further details are available at the following URL: https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide
Other sources
Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint /upload which handles request with the filename parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate their privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. This issue has been addressed in version 1.3.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the impact of CVE-2023-43802?
The vulnerability allows a user to escalate their privileges on the system.
What does CVE-2023-43802 affect?
The vulnerability affects the endpoint `/upload`.
How can the privilege escalation occur with CVE-2023-43802?
The privilege escalation can occur by performing HTTP requests to the localhost interface or bypassing the CORS configuration.
How do I fix CVE-2023-43802?
To fix CVE-2023-43802, update to version 1.3.3 or higher of the `github.com/arduino/arduino-create-agent` package.
Where can I find more information about CVE-2023-43802?
You can find more information about CVE-2023-43802 in the following references: - [Advisory on GitHub](https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-75j7-w798-cwwx) - [Release Tag on GitHub](https://github.com/arduino/arduino-create-agent/releases/tag/1.3.3) - [Advisory on GitHub Advisories](https://github.com/advisories/GHSA-75j7-w798-cwwx)