CVE-2023-43616 Sender can cause a receiver to overwrite files during ZIP extraction in Croc

What is CVE-2023-43616?

CVE-2023-43616 is a medium-severity path traversal vulnerability in n/a, published on 20 Sep 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction.

Weakness: CWE-22

Which versions are affected by CVE-2023-43616?

6 open source packages ship an affected version, including github.com/schollz/croc, github.com/schollz/croc/v6 and github.com/schollz/croc/v8. It affects 1 product.

Products include Schollz Croc.

How do I fix CVE-2023-43616?

Upgrade github.com/schollz/croc to 9.6.16 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-43616 being exploited?

There is no known exploitation of CVE-2023-43616 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2023-43619 Croc sender may send dangerous new files to receiver High 7.8
• CVE-2023-43620 Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device High 7.8
• CVE-2023-43617 Cros secrets may be disclosed to untrusted relay Medium 5.3
• CVE-2023-43618 Croc requires senders to provide local IP addresses in cleartext Medium 5.3
• CVE-2023-43621 Croc may expose secret to local users Medium 4.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2024-MU32583, GHSA-8c8w-f7wp-2jr2, GO-2023-2071.