CVE-2023-22336
📋 TL;DR
This is a path traversal vulnerability in SS1 and Rakuraku PC Cloud Agent software that allows attackers to upload files to arbitrary directories. When combined with CVE-2023-22335 and CVE-2023-22344, it enables remote code execution with SYSTEM privileges. Organizations using affected versions of these Japanese software products are at risk.
💻 Affected Systems
- SS1
- Rakuraku PC Cloud Agent
📦 What is this software?
Ss1 by Dos Osaka
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains SYSTEM privileges and full control of affected systems, potentially leading to data theft, ransomware deployment, or network compromise.
Likely Case
Attackers upload malicious files to sensitive directories, enabling persistence, lateral movement, or data exfiltration.
If Mitigated
Attackers can only upload files to limited directories with minimal impact if proper access controls and monitoring are in place.
🎯 Exploit Status
Requires chaining with two other CVEs for full RCE. Path traversal component alone allows file upload to arbitrary locations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: SS1: Update beyond Ver.13.0.0.40, Rakuraku PC Cloud Agent: Update beyond Ver.2.1.8
Vendor Advisory: https://www.dos-osaka.co.jp/news/2023/03/230301.html
Restart Required: Yes
Instructions:
1. Download latest version from vendor website. 2. Backup current installation. 3. Install update following vendor instructions. 4. Restart affected systems.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected systems from internet and restrict network access
File Upload Restrictions
allImplement strict file upload validation and path sanitization
🧯 If You Can't Patch
- Remove affected software from internet-facing systems immediately
- Implement strict network monitoring for unusual file upload patterns
🔍 How to Verify
Check if Vulnerable:
Check software version in application interface or installation directoryCheck Version:
Check application 'About' section or installation propertiesVerify Fix Applied:
Verify version number is above affected versions: SS1 >13.0.0.40, Rakuraku PC Cloud Agent >2.1.8📡 Detection & Monitoring
Log Indicators:
- Unusual file upload patterns
- Access to sensitive directories
- Script execution from unexpected locations
Network Indicators:
- HTTP requests with directory traversal patterns (../ sequences)
- Unexpected file uploads to application endpoints
SIEM Query:
source="application_logs" AND (event="file_upload" AND path="*../*") OR (process_execution AND parent_process="unexpected")