GitHub Advisoryadvisory · Go
GHSA-75j7-w798-cwwx Arduino Create Agent path traversal - local privilege escalation vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2023-43802
- Ecosystem
- Go
- Packages
- github.com/arduino/arduino-create-agent
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
- Weaknesses
- CWE-22, CWE-35
- Reviewed
- 2023-10-18
Affected packages
• Go github.com/arduino/arduino-create-agent: < 1.3.3 → fixed in 1.3.3
Description
Impact
The vulnerability affects the endpoint `/upload` which handles request with the `filename` parameter.
A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request.
Further details are available in the references.
Fixed Version
• `1.3.3`
References
The issue was reported by Nozomi Networks Labs. Further details are available at the following URL:
• https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide
Related
Alias · CVE (1)
- CVE-2023-43802 Arduino Create Agent is a package to help manage Arduino development. vulnerability
References
- https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-75j7-w798-cwwx web
- https://nvd.nist.gov/vuln/detail/CVE-2023-43802 advisory
- https://github.com/arduino/arduino-create-agent package
- https://github.com/arduino/arduino-create-agent/releases/tag/1.3.3 web
- https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide web