CVE-2023-33365
📋 TL;DR
An unauthenticated path traversal vulnerability in Suprema BioStar 2 allows attackers to read arbitrary files from the web server. This affects BioStar 2 installations before version 2.9.1. Attackers can exploit this without credentials to access sensitive system files.
💻 Affected Systems
- Suprema BioStar 2
📦 What is this software?
Biostar 2 by Supremainc
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive files like configuration files, password hashes, or database credentials, potentially leading to full system compromise.
Likely Case
Attackers will read configuration files and sensitive data, enabling further attacks like credential theft or lateral movement.
If Mitigated
With proper network segmentation and access controls, impact is limited to file disclosure without escalation.
🎯 Exploit Status
Exploitation requires simple HTTP requests with directory traversal sequences.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.1
Vendor Advisory: https://kb.supremainc.com/knowledge/doku.php?id=en:release_note_291
Restart Required: Yes
Instructions:
1. Download BioStar 2 version 2.9.1 from Suprema's official site. 2. Backup current configuration and data. 3. Run the installer to upgrade. 4. Restart the BioStar 2 service.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict access to BioStar 2 web interface to trusted IPs only.
Web Server Configuration
allConfigure web server to block directory traversal sequences in URLs.
🧯 If You Can't Patch
- Isolate BioStar 2 server from internet and restrict internal network access.
- Implement WAF rules to block path traversal patterns in HTTP requests.
🔍 How to Verify
Check if Vulnerable:
Check BioStar 2 version in web interface or installation directory. If version is below 2.9.1, it's vulnerable.Check Version:
Check web interface login page or installation directory for version file.Verify Fix Applied:
Confirm version is 2.9.1 or higher in web interface or via version check command.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' sequences or attempts to access unusual file paths
Network Indicators:
- Unusual file read patterns from unauthenticated sources
SIEM Query:
source="webserver" AND (url="*../*" OR url="*..\\*" OR status=200 AND file_extension IN ('.conf', '.ini', '.txt', '.xml'))