CVE-2023-43803: Github.com/arduino/arduino create agent Path Traversal Vulnerability
MODERATECVE-2023-43803 is a MODERATE (CVSS 6.1) path traversal vulnerability (CWE-35: Path Traversal: '.../...//') affecting Github.com/arduino/arduino create agent libraries in the Go ecosystem. The issue involves arduino create agent path traversal - arbitrary file deletion vulnerability. Remediation is available by upgrading affected packages to version 1.3.3.
CVE-2023-43803 at a Glance
Security Impact
CVSS: 6.1
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).
How to Fix CVE-2023-43803
To remediate this vulnerability, upgrade all affected Github.com/arduino/arduino create agent dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/arduino/arduino-create-agent to 1.3.3Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/arduino/arduino-create-agentHow to Check if You Are Affected
To determine whether your application is affected by CVE-2023-43803, inspect your project dependencies for Github.com/arduino/arduino create agent:
inspect dependencies for github.com/arduino/arduino-create-agentAnalyze the terminal output to locate any version of Github.com/arduino/arduino create agent in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.3.3), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-35: Path Traversal: '.../...//', where the product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. In Github.com/arduino/arduino create agent, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2023-43803 Affected Github.com/arduino/arduino create agent Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/arduino/arduino-create-agent
|
Go |
< 1.3.3
|
1.3.3
|
References
Frequently Asked Questions
What is CVE-2023-43803?
Which Github.com/arduino/arduino create agent versions are affected?
What version fixes CVE-2023-43803?
Is github.com/arduino/arduino-create-agent affected?
What is the CVSS score of CVE-2023-43803?
What CWE is associated with CVE-2023-43803?
How can I check Go dependencies for CVE-2023-43803?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-m5jc-r4gf-c6p8",
"modified" : "2023-11-02T17:34:40Z",
"published" : "2023-10-18T18:25:34Z",
"aliases" : [ "CVE-2023-43803" ],
"summary" : "Arduino Create Agent path traversal - arbitrary file deletion vulnerability",
"details" : "### Impact\nThe vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input.\nA user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP POST request.\nFurther details are available in the references.\n\n### Fixed Version\n* `1.3.3`\n\n### References\nThe issue was reported by Nozomi Networks Labs. Further details on the issue are available at the following URL:\n* https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide\n",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/arduino/arduino-create-agent"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.3.3"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-m5jc-r4gf-c6p8"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-43803"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/arduino/arduino-create-agent"
}, {
"type" : "WEB",
"url" : "https://github.com/arduino/arduino-create-agent/releases/tag/1.3.3"
}, {
"type" : "WEB",
"url" : "https://lists.debian.org/debian-lts-announce/2023/11/msg00005.html"
}, {
"type" : "WEB",
"url" : "https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-22", "CWE-35" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2023-10-18T18:25:34Z",
"nvd_published_at" : "2023-10-18T21:15:09Z"
}
}