CVE-2023-37601
📋 TL;DR
Office Suite Premium v10.9.1.42602 contains a local file inclusion vulnerability via the /etc/hosts component. This allows attackers to read arbitrary files on the system. Users running this specific version are affected.
💻 Affected Systems
- Office Suite Premium
📦 What is this software?
Office Suite by Mobisystems
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive files like /etc/shadow, SSH keys, or configuration files containing credentials.
Likely Case
Information disclosure of sensitive system files, potentially leading to credential theft or further exploitation.
If Mitigated
Limited to reading non-sensitive files if proper file permissions and access controls are implemented.
🎯 Exploit Status
Exploit details are publicly available on Packet Storm, making this easy to weaponize.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Check vendor website for updates or contact vendor support for patching guidance.
🔧 Temporary Workarounds
Restrict file access permissions
linuxSet strict file permissions on sensitive system files to prevent reading via LFI.
chmod 600 /etc/shadow
chmod 600 /etc/passwd
Network segmentation
allIsolate affected systems from untrusted networks to limit attack surface.
🧯 If You Can't Patch
- Disable or remove the vulnerable component if not essential.
- Implement web application firewall (WAF) rules to block LFI attempts.
🔍 How to Verify
Check if Vulnerable:
Check if Office Suite Premium version is 10.9.1.42602 via software settings or vendor documentation.Check Version:
Check software version in application settings or vendor-provided tools.Verify Fix Applied:
Verify by testing if LFI attempts via /etc/hosts are blocked or patched version is installed.📡 Detection & Monitoring
Log Indicators:
- Unusual file access attempts to /etc/hosts or other system files in application logs.
Network Indicators:
- HTTP requests containing file paths like /etc/hosts or directory traversal patterns.
SIEM Query:
source="app_logs" AND (path="/etc/hosts" OR path CONTAINS "../")