High severity · published Oct 18, 2023
CVE-2023-43802
Path traversal in Arduino Create Agent
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/upload` which handles request with the `filename` parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate their privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
arduino-create-agent · arduino
< 1.3.3 · source: vendor
CA
Create Agent · Arduino
before 1.3.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-43802
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-43802
github.com
https://github.com/arduino/arduino-create-agent/releases/tag/1.3.3
Vendor Advisory
https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-75j7-w798-cwwx
www.nozominetworks.com
https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide
More from arduino-create-agent
7.8
CVE-2023-43800
Insufficient Verification of Data Authenticity in Arduino Create Agent
7.1
CVE-2023-43801
Path traversal in Arduino Create Agent
7.1
CVE-2023-43803
Path traversal in Arduino Create Agent
6.1
CVE-2023-49296
Arduino Create Agent vulnerable to Reflected Cross-Site Scripting