CVE-2023-35853
📋 TL;DR
This vulnerability allows an adversary who controls an external source of Lua rules to execute arbitrary Lua code in Suricata. It affects Suricata installations before version 6.0.13 that use Lua rules from untrusted sources. The CVSS score of 9.8 indicates critical severity.
💻 Affected Systems
- Suricata
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through remote code execution, potentially allowing attacker to take control of the Suricata host, pivot to other systems, or disrupt network monitoring.
Likely Case
Execution of malicious Lua code within Suricata's context, potentially leading to data exfiltration, network traffic manipulation, or denial of service.
If Mitigated
Limited impact if Lua is disabled or only trusted rule sources are used, with potential for rule validation bypass at most.
🎯 Exploit Status
Exploitation requires control over Lua rule source, which could be achieved through various means including supply chain compromise or rule repository access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.13
Vendor Advisory: https://github.com/OISF/suricata/commit/b95bbcc66db526ffcc880eb439dbe8abc87a81da
Restart Required: Yes
Instructions:
1. Upgrade Suricata to version 6.0.13 or later. 2. Restart Suricata service. 3. Verify the security.lua.allow-rules setting is properly configured if using Lua rules.
🔧 Temporary Workarounds
Disable Lua rules
allCompletely disable Lua functionality in Suricata configuration
Edit suricata.yaml: set 'lua.enabled: false'
Restrict Lua rule sources
allOnly allow Lua rules from trusted, controlled sources
Edit suricata.yaml security.lua section: set 'allow-rules: false' and only enable for specific trusted paths
🧯 If You Can't Patch
- Disable Lua functionality entirely in configuration
- Implement strict network controls to prevent Suricata from accessing external rule sources
🔍 How to Verify
Check if Vulnerable:
Check Suricata version with 'suricata --build-info' and verify if version is below 6.0.13 and Lua is enabled in configuration.Check Version:
suricata --build-info | grep 'Version'Verify Fix Applied:
Verify version is 6.0.13 or higher with 'suricata --build-info' and check that security.lua.allow-rules is properly configured.📡 Detection & Monitoring
Log Indicators:
- Unexpected Lua rule loading from external sources
- Suricata process executing unexpected system commands
- Errors related to Lua rule parsing
Network Indicators:
- Suricata downloading rules from unexpected external sources
- Outbound connections from Suricata process to suspicious destinations
SIEM Query:
process.name:suricata AND (network.destination.ip:<external_ip> OR process.args:*lua*)🔗 References
- https://github.com/OISF/suricata/commit/b95bbcc66db526ffcc880eb439dbe8abc87a81da
- https://github.com/OISF/suricata/compare/suricata-6.0.12...suricata-6.0.13
- https://www.stamus-networks.com/stamus-labs
- https://github.com/OISF/suricata/commit/b95bbcc66db526ffcc880eb439dbe8abc87a81da
- https://github.com/OISF/suricata/compare/suricata-6.0.12...suricata-6.0.13
- https://www.stamus-networks.com/stamus-labs
