CVE-2023-43800

Insufficient Verification of Data Authenticity in Arduino Create Agent

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this issue.

Arduino Create Agent es un paquete para ayudar a gestionar el desarrollo de Arduino. La vulnerabilidad afecta al endpoint `/v2/pkgs/tools/installed`. Un usuario que tiene la capacidad de realizar solicitudes HTTP a la interfaz del host local, o que puede omitir la configuración CORS, puede escalar sus privilegios a los del usuario que ejecuta el servicio Arduino Create Agent a través de una solicitud HTTP POST manipulada. Este problema se solucionó en la versión "1.3.3". Se recomienda a los usuarios que actualicen. No se conocen workarounds para este problema.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-09-22 CVE Reserved
2023-10-18 CVE Published
2023-11-03 EPSS Updated
2024-09-12 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-345: Insufficient Verification of Data Authenticity

CAPEC

References (3)

URL	Tag	Source
https://github.com/arduino/arduino-create-agent/releases/tag/1.3.3	X_refsource_misc
https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide	X_refsource_misc

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-4x5q-q7wc-q22p	2023-11-02

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Arduino Search vendor "Arduino"		Create Agent Search vendor "Arduino" for product "Create Agent"				< 1.3.3 Search vendor "Arduino" for product "Create Agent" and version " < 1.3.3"		go		Affected