CVE-2023-35852 Path traversal in n/a
An attacker controlling rule sources can exploit path traversal in Suricata to write files to the local filesystem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-35852?
CVE-2023-35852 is a high-severity path traversal vulnerability in Oisf Suricata, published on 19 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Suricata before 6.0.13 (when there is an adversary who controls an external source of rules), a dataset filename, that comes from a rule, may trigger absolute or relative directory traversal, and lead to write access to a local filesystem. This is addressed in 6.0.13 by requiring allow-absolute-filenames and allow-write (in the datasets rules configuration section) if an installation requires traversal/writing in this situation.
Weakness: CWE-22
Which versions are affected by CVE-2023-35852?
It affects 1 product.
Products include Oisf Suricata.
How do I fix CVE-2023-35852?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-35852 being exploited?
There is no known exploitation of CVE-2023-35852 in the wild and no public exploit code.
Other vulnerabilities in Oisf Suricata
Sources
Also known as DEBIAN-CVE-2023-35852, GHSA-747h-x2cf-7vm7, UBUNTU-CVE-2023-35852.