CVE-2023-46307
📋 TL;DR
CVE-2023-46307 is a directory traversal vulnerability in etcd-browser that allows attackers to read arbitrary files on the server by manipulating URL paths with sequences like /../../../. This affects anyone running the vulnerable version of etcd-browser exposed to untrusted networks.
💻 Affected Systems
- etcd-browser
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive files like SSH keys, configuration files, or credentials, potentially leading to lateral movement and data exfiltration.
Likely Case
Unauthorized access to sensitive system files, configuration data, or application secrets stored on the server.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external exploitation.
🎯 Exploit Status
Simple HTTP GET request manipulation required. Public disclosure includes technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
No official patch available. Consider workarounds or alternative software.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict access to etcd-browser to trusted networks only
iptables -A INPUT -p tcp --dport <etcd-port> -s <trusted-network> -j ACCEPT
iptables -A INPUT -p tcp --dport <etcd-port> -j DROP
Reverse Proxy with Path Validation
allUse a reverse proxy like nginx to filter malicious path traversal attempts
location / {
proxy_pass http://localhost:<etcd-port>;
if ($request_uri ~* "\.\.") {
return 403;
}
}
🧯 If You Can't Patch
- Remove etcd-browser from internet-facing networks immediately
- Implement strict network segmentation and monitor for suspicious file access patterns
🔍 How to Verify
Check if Vulnerable:
Test with curl: curl -v 'http://<target>:<port>/../../../etc/passwd' and check if file contents are returnedCheck Version:
Check Docker container tag or application version in running instanceVerify Fix Applied:
Retest with same curl command after implementing workarounds - should receive 403/404 error📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing /../../../ patterns
- Unusual file access patterns from etcd-browser process
Network Indicators:
- HTTP GET requests with multiple directory traversal sequences
SIEM Query:
source="etcd-browser" AND uri="*../*"🔗 References
- http://seclists.org/fulldisclosure/2023/Nov/11
- http://seclists.org/fulldisclosure/2023/Nov/9
- https://hub.docker.com/r/buddho/etcd-browser
- https://hub.docker.com/r/buddho/etcd-browser/tags
- http://seclists.org/fulldisclosure/2023/Nov/11
- http://seclists.org/fulldisclosure/2023/Nov/9
- https://hub.docker.com/r/buddho/etcd-browser
- https://hub.docker.com/r/buddho/etcd-browser/tags
