CVE-2023-39810
📋 TL;DR
A directory traversal vulnerability in BusyBox's cpio command allows attackers to write files outside the intended extraction directory. This affects systems using BusyBox v1.33.2 with cpio functionality, particularly embedded devices, routers, and containers. Attackers can potentially overwrite critical system files or plant malicious executables.
💻 Affected Systems
- BusyBox
📦 What is this software?
Busybox by Busybox
Busybox by Busybox
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via overwriting critical files like /etc/passwd, /etc/shadow, or planting backdoors in system binaries.
Likely Case
Local privilege escalation, denial of service by corrupting system files, or persistence mechanisms via malicious scripts.
If Mitigated
Limited impact if cpio is not used with untrusted archives, or if filesystem permissions restrict write access to sensitive locations.
🎯 Exploit Status
Exploitation requires local access or ability to supply malicious cpio archives. Public proof-of-concept demonstrates directory traversal.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: BusyBox v1.33.3 and later
Vendor Advisory: http://busybox.com
Restart Required: No
Instructions:
1. Download latest BusyBox from http://busybox.net/downloads. 2. Replace existing busybox binary. 3. Verify with 'busybox --version'.
🔧 Temporary Workarounds
Disable cpio applet
linuxRemove cpio functionality from BusyBox build
make menuconfig
Navigate to Archival Utilities -> cpio and disable
Restrict cpio usage
linuxUse filesystem permissions to limit who can execute cpio
chmod 750 /bin/busybox
setfacl -m u:root:rx /bin/busybox
🧯 If You Can't Patch
- Monitor and audit cpio usage patterns for suspicious archive extraction
- Implement strict input validation for any cpio archive sources
🔍 How to Verify
Check if Vulnerable:
Check BusyBox version: 'busybox --version | grep 1.33.2'Check Version:
busybox --versionVerify Fix Applied:
Verify version is 1.33.3 or higher: 'busybox --version | grep -v 1.33.2'📡 Detection & Monitoring
Log Indicators:
- cpio extraction logs with suspicious file paths containing '..'
- Failed file writes outside expected directories
Network Indicators:
- Unusual archive downloads followed by cpio execution
SIEM Query:
process.name='busybox' AND cmdline CONTAINS 'cpio' AND cmdline CONTAINS '..'🔗 References
- http://busybox.com
- https://www.pentagrid.ch/en/blog/busybox-cpio-directory-traversal-vulnerability/
- http://busybox.com
- http://www.openwall.com/lists/oss-security/2025/04/23/1
- http://www.openwall.com/lists/oss-security/2025/04/23/2
- http://www.openwall.com/lists/oss-security/2025/04/23/3
- http://www.openwall.com/lists/oss-security/2025/04/24/2
- https://www.pentagrid.ch/en/blog/busybox-cpio-directory-traversal-vulnerability/
