CVE-2017-3852 Path traversal in Cisco Application-Hosting Framework

High 8.1 Published 22 Mar 2017 Updated 5 Aug 2024

Authenticated attackers can modify arbitrary files within Cisco IOx virtual instances via malicious application packages due to insufficient input validation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-3852?

CVE-2017-3852 is a high-severity path traversal vulnerability in Cisco Application-Hosting Framework, published on 22 Mar 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the Cisco application-hosting framework (CAF) component of the Cisco IOx application environment could allow an authenticated, remote attacker to write or modify arbitrary files in the virtual instance running on the affected device. The vulnerability is due to insufficient input validation of user-supplied application packages. An attacker who can upload a malicious package within Cisco IOx could exploit the vulnerability to modify arbitrary files. The impacts of a successful exploit are limited to the scope of the virtual instance and do not impact the router that is hosting Cisco IOx. Cisco IOx Releases 1.0.0.0 and 1.1.0.0 are vulnerable. Cisco Bug IDs: CSCuy52317.

Weakness: CWE-20

Which versions are affected by CVE-2017-3852?

It affects 1 product.

Products include Cisco Iox.

How do I fix CVE-2017-3852?

No fix has been published for CVE-2017-3852 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2017-3852 being exploited?

There is no known exploitation of CVE-2017-3852 in the wild and no public exploit code.

Sources

Also known as GHSA-24qc-25f9-3h95.