CVE-2023-3512
📋 TL;DR
This vulnerability allows attackers to download arbitrary files from affected systems using relative path traversal in the 'Download file' parameter. It affects Setelsa Security's ConacWin CB version 3.8.2.2 and earlier. Organizations using this software for security management are at risk.
💻 Affected Systems
- Setelsa Security ConacWin CB
📦 What is this software?
Conacwin by Setelsa Security
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through downloading sensitive files like configuration files, passwords, or system files leading to further attacks.
Likely Case
Unauthorized access to sensitive configuration data, user credentials, or system information that could facilitate lateral movement.
If Mitigated
Limited to downloading non-sensitive files if proper file permissions and access controls are implemented.
🎯 Exploit Status
Exploitation requires only manipulating the file download parameter with directory traversal sequences like '../'.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.8.2.3 or later
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/relative-path-traversal-setelsa-security-conacwin
Restart Required: Yes
Instructions:
1. Download the latest version from Setelsa Security. 2. Backup current configuration. 3. Install the update. 4. Restart the ConacWin CB service.
🔧 Temporary Workarounds
Input Validation Filter
allImplement input validation to reject directory traversal sequences in file download requests.
Implement server-side validation to sanitize file paths before processing.
Network Segmentation
allRestrict network access to ConacWin CB to only authorized users and systems.
Configure firewall rules to limit access to ConacWin CB ports.
🧯 If You Can't Patch
- Implement strict file system permissions to limit accessible directories.
- Deploy a web application firewall (WAF) with rules to block path traversal attempts.
🔍 How to Verify
Check if Vulnerable:
Test the file download functionality with path traversal payloads like '../../etc/passwd' or similar Windows paths.Check Version:
Check the ConacWin CB interface or installation directory for version information.Verify Fix Applied:
Attempt the same path traversal tests after patching; successful downloads should be blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual file download requests containing '../' sequences
- Multiple failed download attempts from single IPs
Network Indicators:
- HTTP requests with path traversal patterns in URL parameters
SIEM Query:
source="conacwin_logs" AND (url="*../*" OR parameter="*../*")