CVE-2023-43620 Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device

What is CVE-2023-43620?

CVE-2023-43620 is a high-severity vulnerability in n/a, published on 20 Sep 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

An issue was discovered in Croc through 9.6.5. A sender may place ANSI or CSI escape sequences in a filename to attack the terminal device of a receiver.

Weakness: CWE-116

Which versions are affected by CVE-2023-43620?

6 open source packages ship an affected version, including github.com/schollz/croc/v9, github.com/schollz/croc and github.com/schollz/croc/v6. It affects 1 product.

Products include Schollz Croc.

How do I fix CVE-2023-43620?

Upgrade github.com/schollz/croc/v9 to 9.6.16 or later.

Is CVE-2023-43620 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-43620 exists.

Other vulnerabilities in n/a

• CVE-2023-43619 Croc sender may send dangerous new files to receiver High 7.8
• CVE-2023-43616 Sender can cause a receiver to overwrite files during ZIP extraction in Croc Medium 5.5
• CVE-2023-43617 Cros secrets may be disclosed to untrusted relay Medium 5.3
• CVE-2023-43618 Croc requires senders to provide local IP addresses in cleartext Medium 5.3
• CVE-2023-43621 Croc may expose secret to local users Medium 4.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2024-RB67185, GHSA-364c-vvqx-446c, GO-2023-2068.