CVE-2023-43803: Path traversal in Arduino Create Agent

Published Oct 18, 2023
·
Updated

Impact The vulnerability affects the endpoint /v2/pkgs/tools/installed and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP POST request. Further details are available in the references.

Fixed Version 1.3.3

References The issue was reported by Nozomi Networks Labs. Further details on the issue are available at the following URL: https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide

Other sources

Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint /v2/pkgs/tools/installed and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP POST request. This issue has been addressed in version 1.3.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected Software

2 affected componentsFixes available
Arduino Create Agent Go<1.3.3
go/github.com/arduino/arduino-create-agent<1.3.3
1.3.3

Event History

Oct 18, 2023
Advisory Published
06:25 PM
CVE Published
via MITRE·08:36 PM
Data Sourced
via MITRE·08:36 PM
DescriptionSeverityWeakness
Data Sourced
09:15 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What is the impact of CVE-2023-43803?

The vulnerability allows an attacker to delete arbitrary files or folders on the affected system.

2

What endpoint is affected by CVE-2023-43803?

The endpoint /v2/pkgs/tools/installed is affected by the vulnerability.

3

How does CVE-2023-43803 handle user input?

CVE-2023-43803 handles plugin names supplied as user input.

4

How can an attacker exploit CVE-2023-43803?

An attacker with the ability to perform HTTP requests to the localhost interface or bypass CORS configuration can exploit CVE-2023-43803.

5

What is the severity of CVE-2023-43803?

CVE-2023-43803 has a severity of medium (6.1).

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203