SecBoard
Zurück zur CVE-Übersicht

CVE-2023-27534

HIGH(8.8)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score23/100 — NIEDRIG
  • CVSS 8.8 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

2.4%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.8

Technische Schwere

Beschreibung

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • curl <8.0.0
  • 7.64.0-4+deb10u9
  • 7.82.0-14.fc36
  • >=8.3.0-r2

Threat-Hunting-Queries

Detect attempts to use SFTP paths with '~' in unexpected positions, potentially indicating path traversal attempts.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "sftp://" and InitiatingProcessCommandLine matches regex "/~[0-9]/"

Splunk SPL

index=* (sftp:// OR "sftp://") | regex _raw="/~[0-9]/"

Sigma

title: Curl SFTP Path Traversal Attempt
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains: 'sftp://'
    CommandLine|re: '/~[0-9]/'
  condition: selection
level: high

Elastic ES|QL

from process where process.command_line : "sftp://*" and process.command_line : "/~[0-9]/"

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Betroffene Produkte

  • cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
  • cpe:2.3:o:broadcom:brocade_fabric_operating_system_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*

Referenzen