CVE-2021-3845
📋 TL;DR
CVE-2021-3845 is a path traversal vulnerability in ws-scrcpy that allows attackers to write files to arbitrary locations on the server filesystem. This affects users running vulnerable versions of ws-scrcpy, particularly those exposing the service to untrusted networks.
💻 Affected Systems
- ws-scrcpy
📦 What is this software?
Ws Scrcpy by Ws Scrcpy Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through arbitrary file write leading to remote code execution, data exfiltration, or system takeover.
Likely Case
Unauthorized file creation/modification in sensitive directories, potentially leading to privilege escalation or service disruption.
If Mitigated
Limited impact with proper file permissions and network segmentation, potentially only affecting non-critical files.
🎯 Exploit Status
The vulnerability is straightforward to exploit with publicly available details in the commit and bounty report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit e83cf65438bef83a3503b25358bba97bcc156fef and later
Vendor Advisory: https://github.com/netristv/ws-scrcpy/commit/e83cf65438bef83a3503b25358bba97bcc156fef
Restart Required: Yes
Instructions:
1. Update ws-scrcpy to version including commit e83cf65438bef83a3503b25358bba97bcc156fef. 2. Restart the ws-scrcpy service. 3. Verify the fix by checking the version.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict network access to ws-scrcpy service to trusted IPs only
Use firewall rules to limit access: iptables -A INPUT -p tcp --dport [ws-scrcpy-port] -s [trusted-ip] -j ACCEPT
iptables -A INPUT -p tcp --dport [ws-scrcpy-port] -j DROP
File System Restrictions
linuxRun ws-scrcpy with minimal file system permissions using containerization or chroot
docker run --read-only -v /tmp:/tmp:rw [ws-scrcpy-image]
chroot /var/empty /path/to/ws-scrcpy
🧯 If You Can't Patch
- Disable or stop the ws-scrcpy service entirely until patching is possible.
- Implement strict network segmentation to isolate the vulnerable system from untrusted networks.
🔍 How to Verify
Check if Vulnerable:
Check if ws-scrcpy version is older than commit e83cf65438bef83a3503b25358bba97bcc156fef by examining the source code or build date.Check Version:
Check the ws-scrcpy source code or binary for version information: grep -r 'version\|commit' /path/to/ws-scrcpy/ or check package manager: dpkg -l | grep ws-scrcpyVerify Fix Applied:
Verify the installed version includes the security fix by checking for the commit hash in the codebase or version string.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations in system logs
- Access attempts to sensitive directories from ws-scrcpy process
- Error logs showing path traversal attempts
Network Indicators:
- Unexpected network traffic to ws-scrcpy service from untrusted sources
- Multiple failed file operation requests
SIEM Query:
source="ws-scrcpy.log" AND ("..\/" OR "%2e%2e%2f" OR "directory traversal")