CVE-2023-25303
📋 TL;DR
CVE-2023-25303 is a directory traversal vulnerability in ATLauncher that allows attackers to create arbitrary files outside the installation directory by crafting malicious mrpack files. This affects all users of ATLauncher versions up to 3.4.26.0 who process untrusted mrpack files.
💻 Affected Systems
- ATLauncher
📦 What is this software?
Atlauncher by Atlauncher
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary file creation, potentially leading to remote code execution, data theft, or system destruction.
Likely Case
Local file system corruption, installation of malware, or privilege escalation through crafted files.
If Mitigated
Limited impact if only trusted mrpack sources are used and proper file system permissions restrict write access.
🎯 Exploit Status
Exploitation requires user to download and process a malicious mrpack file; no authentication needed for the file processing itself.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.27.0
Vendor Advisory: https://github.com/ATLauncher/ATLauncher/security/advisories/GHSA-7cff-8xv4-mvx6
Restart Required: Yes
Instructions:
1. Download ATLauncher 3.4.27.0 or later from official sources. 2. Install the update. 3. Restart ATLauncher.
🔧 Temporary Workarounds
Restrict mrpack sources
allOnly download and process mrpack files from trusted, verified sources.
Run with limited permissions
allRun ATLauncher with user account that has restricted file system write permissions.
🧯 If You Can't Patch
- Discontinue use of ATLauncher for processing mrpack files until patched.
- Implement strict file integrity monitoring for ATLauncher installation directory.
🔍 How to Verify
Check if Vulnerable:
Check ATLauncher version in application settings or about dialog; if version is 3.4.26.0 or earlier, it is vulnerable.Check Version:
Check Help > About in ATLauncher GUI or examine application metadata files.Verify Fix Applied:
Verify ATLauncher version is 3.4.27.0 or later after update.📡 Detection & Monitoring
Log Indicators:
- Unusual file creation events outside ATLauncher directories
- Errors related to path traversal in application logs
Network Indicators:
- Downloads of mrpack files from untrusted sources
SIEM Query:
File creation events where path contains '..' or absolute paths in ATLauncher process context.🔗 References
- https://github.com/ATLauncher/ATLauncher/security/advisories/GHSA-7cff-8xv4-mvx6
- https://quiltmc.org/en/blog/2023-02-04-five-installer-vulnerabilities/
- https://github.com/ATLauncher/ATLauncher/security/advisories/GHSA-7cff-8xv4-mvx6
- https://quiltmc.org/en/blog/2023-02-04-five-installer-vulnerabilities/
