CVE-2023-33871
📋 TL;DR
CVE-2023-33871 is a directory traversal vulnerability in Iagona ScrutisWeb that allows unauthenticated attackers to access files outside the webroot directory. This affects versions 2.1.37 and earlier of the software, potentially exposing sensitive configuration files, credentials, or system data.
💻 Affected Systems
- Iagona ScrutisWeb
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could retrieve sensitive system files, configuration data, or credentials, leading to complete system compromise, data exfiltration, or lateral movement within the network.
Likely Case
Unauthenticated attackers accessing configuration files, logs, or other sensitive data stored outside the webroot, potentially enabling further attacks.
If Mitigated
Limited impact with proper network segmentation, web application firewalls, and file permission restrictions in place.
🎯 Exploit Status
Directory traversal vulnerabilities typically have low exploitation complexity and can be exploited with simple HTTP requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.1.38 or later
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-03
Restart Required: Yes
Instructions:
1. Download the latest version from Iagona. 2. Backup current installation. 3. Install the updated version. 4. Restart the ScrutisWeb service. 5. Verify the update was successful.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to ScrutisWeb to trusted networks only
Web Application Firewall
allImplement WAF rules to block directory traversal patterns
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Deploy a web application firewall with directory traversal protection rules
🔍 How to Verify
Check if Vulnerable:
Check the ScrutisWeb version in the application interface or configuration files. If version is 2.1.37 or earlier, the system is vulnerable.Check Version:
Check the application web interface or configuration files for version informationVerify Fix Applied:
Verify the version has been updated to 2.1.38 or later and test that directory traversal attempts are properly blocked.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' or similar traversal patterns
- Access to files outside expected webroot directories
- Unauthenticated requests to sensitive file paths
Network Indicators:
- HTTP requests with directory traversal sequences in URLs or parameters
- Unusual file access patterns from external IPs
SIEM Query:
source="scrutisweb" AND (url="*../*" OR url="*..\\*" OR url="*%2e%2e%2f*")