CVE-2023-43364
📋 TL;DR
CVE-2023-43364 is a critical remote code execution vulnerability in Searchor's main.py that uses eval() on untrusted CLI input. This allows attackers to execute arbitrary commands on systems running vulnerable versions. Anyone using Searchor 2.4.1 or earlier is affected.
💻 Affected Systems
- Searchor
📦 What is this software?
Searchor by Arjunsharda
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the affected system, allowing data theft, ransomware deployment, or lateral movement.
Likely Case
Remote code execution leading to data exfiltration, cryptocurrency mining, or botnet enrollment.
If Mitigated
No impact if patched or proper input validation is implemented.
🎯 Exploit Status
Multiple public proof-of-concept exploits exist demonstrating arbitrary command execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.2
Vendor Advisory: https://github.com/advisories/GHSA-66m2-493m-crh2
Restart Required: No
Instructions:
1. Update Searchor using pip: pip install --upgrade searchor==2.4.2
2. Verify installation: pip show searchor
3. Confirm version is 2.4.2 or higher
🔧 Temporary Workarounds
Input Validation Wrapper
linuxCreate a wrapper script that sanitizes input before passing to Searchor
#!/bin/bash
# Validate input contains only alphanumeric characters
if [[ "$1" =~ ^[a-zA-Z0-9\s]+$ ]]; then
searchor "$1"
else
echo "Invalid input"
fi
🧯 If You Can't Patch
- Remove Searchor from production systems immediately
- Implement strict network segmentation to isolate affected systems
🔍 How to Verify
Check if Vulnerable:
Check Searchor version: pip show searchor | grep VersionCheck Version:
pip show searchor | grep VersionVerify Fix Applied:
Confirm version is 2.4.2 or higher: pip show searchor | grep Version📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns from Searchor process
- Suspicious system commands in Searchor logs
Network Indicators:
- Outbound connections to suspicious IPs from Searchor process
- Unexpected data exfiltration
SIEM Query:
process.name:"python" AND process.args:"searchor" AND process.args:"eval"🔗 References
- https://github.com/ArjunSharda/Searchor/commit/16016506f7bf92b0f21f51841d599126d6fcd15b
- https://github.com/ArjunSharda/Searchor/pull/130
- https://github.com/advisories/GHSA-66m2-493m-crh2
- https://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit-
- https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection
- https://github.com/ArjunSharda/Searchor/commit/16016506f7bf92b0f21f51841d599126d6fcd15b
- https://github.com/ArjunSharda/Searchor/pull/130
- https://github.com/advisories/GHSA-66m2-493m-crh2
- https://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit-
- https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection
