CVE-2023-43091
📋 TL;DR
CVE-2023-43091 is a critical code injection vulnerability in GNOME Maps that allows arbitrary code execution via malicious service.json configuration files. This affects all GNOME Maps users who open or process untrusted configuration files. Attackers can achieve remote code execution with high privileges.
💻 Affected Systems
- GNOME Maps
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the GNOME Maps user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or remote code execution when users open malicious configuration files, leading to malware installation or data exfiltration.
If Mitigated
Limited impact with proper file permissions and user awareness, potentially only affecting isolated user sessions.
🎯 Exploit Status
Exploitation requires the victim to open a malicious service.json file; no authentication bypass needed beyond file access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version containing commit d26cd774d524404ef7784e6808f551de83de4bea
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2239091
Restart Required: No
Instructions:
1. Update GNOME Maps through your distribution's package manager. 2. For source installations, apply commit d26cd774d524404ef7784e6808f551de83de4bea. 3. Verify the fix by checking the version.
🔧 Temporary Workarounds
Restrict service.json file permissions
linuxSet strict file permissions on service.json to prevent unauthorized modifications
chmod 644 /path/to/service.json
chown root:root /path/to/service.json
Disable GNOME Maps
linuxTemporarily disable or remove GNOME Maps if not needed
sudo apt remove gnome-maps
sudo yum remove gnome-maps
🧯 If You Can't Patch
- Implement strict file integrity monitoring on service.json files
- Educate users about the risks of opening untrusted configuration files
🔍 How to Verify
Check if Vulnerable:
Check if GNOME Maps version predates commit d26cd774d524404ef7784e6808f551de83de4beaCheck Version:
gnome-maps --versionVerify Fix Applied:
Verify the installed version includes the security patch or check for the specific commit hash📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from GNOME Maps
- Modifications to service.json file
Network Indicators:
- Outbound connections from GNOME Maps to unexpected destinations
SIEM Query:
process_name:"gnome-maps" AND (process_execution OR file_modification:service.json)