High severity · published Oct 18, 2023
CVE-2023-43801
Path traversal in Arduino Create Agent
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP DELETE request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
arduino-create-agent · arduino
< 1.3.3 · source: vendor
CA
Create Agent · Arduino
before 1.3.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-43801
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-43801
github.com
https://github.com/arduino/arduino-create-agent/releases/tag/1.3.3
Vendor Advisory
https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-mjq6-pv9c-qppq
www.nozominetworks.com
https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide
More from arduino-create-agent
7.8
CVE-2023-43800
Insufficient Verification of Data Authenticity in Arduino Create Agent
7.8
CVE-2023-43802
Path traversal in Arduino Create Agent
7.1
CVE-2023-43803
Path traversal in Arduino Create Agent
6.1
CVE-2023-49296
Arduino Create Agent vulnerable to Reflected Cross-Site Scripting