CVE-2023-37474
📋 TL;DR
CVE-2023-37474 is a path traversal vulnerability in Copyparty file server versions before 1.8.2 that allows attackers to access files outside the web root directory via the .cpr subfolder. This affects all users running vulnerable Copyparty instances, potentially exposing sensitive system files. The vulnerability is particularly dangerous for internet-facing servers.
💻 Affected Systems
- Copyparty
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive files like /etc/passwd, SSH keys, or configuration files, potentially leading to credential theft and lateral movement.
Likely Case
Unauthorized access to sensitive files stored on the server, including application data, configuration files, and user uploads.
If Mitigated
Limited impact if server runs with minimal privileges and filesystem permissions restrict access to sensitive areas.
🎯 Exploit Status
Proof-of-concept exploit code is publicly available on Packet Storm Security; exploitation requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.2
Vendor Advisory: https://github.com/9001/copyparty/security/advisories/GHSA-pxfv-7rr3-2qjg
Restart Required: Yes
Instructions:
1. Stop the Copyparty service. 2. Update to version 1.8.2 or later using pip: 'pip install --upgrade copyparty'. 3. Restart the Copyparty service.
🔧 Temporary Workarounds
Disable .cpr subfolder
linuxRemove or disable access to the .cpr directory functionality
rm -rf /path/to/copyparty/.cpr
chmod 000 /path/to/copyparty/.cpr
🧯 If You Can't Patch
- Run Copyparty with minimal filesystem permissions using chroot or containerization
- Implement strict network access controls to limit exposure to trusted networks only
🔍 How to Verify
Check if Vulnerable:
Check if Copyparty version is below 1.8.2 and if .cpr directory exists and is accessibleCheck Version:
copyparty --versionVerify Fix Applied:
Verify version is 1.8.2 or higher and test path traversal attempts to .cpr return proper errors📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to .cpr directory
- HTTP requests containing path traversal sequences like '../'
Network Indicators:
- HTTP requests to .cpr paths with traversal sequences
- Unusual file access patterns from single IP
SIEM Query:
source="copyparty.log" AND (uri="*../*" OR uri="*/.cpr/*")🔗 References
- http://packetstormsecurity.com/files/173822/Copyparty-1.8.2-Directory-Traversal.html
- https://github.com/9001/copyparty/commit/043e3c7dd683113e2b1c15cacb9c8e68f76513ff
- https://github.com/9001/copyparty/security/advisories/GHSA-pxfv-7rr3-2qjg
- http://packetstormsecurity.com/files/173822/Copyparty-1.8.2-Directory-Traversal.html
- https://github.com/9001/copyparty/commit/043e3c7dd683113e2b1c15cacb9c8e68f76513ff
- https://github.com/9001/copyparty/security/advisories/GHSA-pxfv-7rr3-2qjg
