CVE-2023-1663

Executive Summary

CVE-2023-1663 is a forced browsing vulnerability in Synopsys Coverity versions prior to 2023.3.2. The root cause is an insecurely configured servlet mapping for the underlying Apache Tomcat server, which exposes the downloads directory and its contents to unauthenticated actors. The vulnerability has a CVSS score of 6.5 (Medium) and an EPSS score of 0.00431, indicating a low probability (35.7th percentile) of active exploitation. No public exploit code or Nuclei template is currently available, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. Patch confidence is rated 2/4, meaning the fix is claimed by a single source (the CNA) but not independently confirmed.

Technical Analysis

The vulnerability class here is forced browsing (also referred to as "direct request" or "predictable resource location"). This is a well-understood class of vulnerability where an application fails to enforce proper authorization checks on resources, relying instead on the obscurity of URLs to protect access. When a servlet mapping is insecurely configured, the underlying web server (in this case Apache Tomcat) may serve files or directories that were not intended for public exposure, bypassing authentication and authorization controls.

The NVD description specifies that the root cause is "an insecurely configured servlet mapping" for the Apache Tomcat server embedded in or used by Coverity. Servlet mappings in Java web applications determine which servlet (or static resource handler) processes a given HTTP request. When a mapping is too broad — for example, using a wildcard pattern that inadvertently maps static file directories to a default servlet — the web container may expose filesystem contents to any requester. In this case, the downloads directory and its contents are accessible.

It is important to note that the NVD description does not specify:

• The exact servlet mapping pattern that is misconfigured
• The specific URL path used to access the downloads directory
• Whether authentication is required for other parts of the application
• The nature of files contained in the downloads directory (e.g., build artifacts, source code, configuration files, credentials)

Given the CVSS vector breakdown — specifically PR:N (no privileges required) and AV:N (network attack vector) — the vulnerable resource is reachable by unauthenticated remote attackers. The confidentiality impact is Low (C:L), suggesting that while sensitive information can be disclosed, the exposed data is limited in scope. The integrity impact is None (I:N), meaning attackers cannot modify data. Availability impact is Low (A:L), which may correspond to an increased attack surface or potential further exploitation opportunities.

The affected product, Synopsys Coverity, is a static analysis (SAST) platform used by development and security teams to identify defects and security vulnerabilities in source code. Coverity is typically deployed in enterprise environments, often in CI/CD pipelines or as a standalone server. The attacker's ability to access the downloads directory could lead to disclosure of project artifacts, potential source code, and possibly sensitive configuration data — all of which could be leveraged in further attacks against the organization.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the CVSS vector.

Step 1 — Reconnaissance / Target Identification: An attacker scans for exposed Coverity instances on the internet using search engine dorks such as title:Coverity or by scanning for common Coverity web application ports. The attacker can also use Shodan to identify potentially vulnerable instances. Since the CVSS vector includes AV:N (network attack vector), no prior access to the internal network is required.

Step 2 — Triggering the Flaw: Once a target is identified, the attacker sends HTTP requests to the Coverity web application, probing predictable paths that correspond to the misconfigured servlet mapping. Given the CNA title "Authenticated Resources Accessible via Forced Browsing," the attacker likely requests the downloads directory path directly, bypassing any login or authentication mechanism. The insecurely configured servlet mapping causes Tomcat to serve files from the downloads directory without enforcing authentication checks.

Step 3 — Payload / Execution Method: At the vulnerability-class level, this is not a code-execution vulnerability; it is an information disclosure flaw. The "payload" is simply a crafted HTTP GET request to a predictable URL path. The attacker may also enumerate filenames within the downloads directory using common directory traversal techniques or by leveraging directory listing (if enabled by the misconfiguration). No authentication credentials or session tokens are required.

Step 4 — Post-Exploitation Impact: Once the downloads directory is accessed, the attacker exfiltrates any files it contains. Depending on the contents, this could include software builds, installer packages, documentation, or potentially configuration files with embedded credentials. Disclosed source code could reveal product internals, proprietary algorithms, or hardcoded secrets that aid further attacks. Combined with the low availability impact, the attacker might also be able to trigger service degradation by exhausting server resources with frequent download requests, effectively using the exposed directory as an unauthenticated file download service.

Impact Assessment

Business Impact: Coverity is used by software development and security teams to analyze source code, typically including proprietary or sensitive projects. Unauthorized disclosure of the downloads directory could expose build artifacts, source code, internal documentation, or configuration details to competitors, threat actors, or other unauthorized parties. This represents a confidentiality breach and may violate contractual data-protection obligations, particularly in sectors with strict compliance requirements (e.g., finance, healthcare, government).

Affected Systems: All Synopsys Coverity installations prior to version 2023.3.2. The deployment architecture (single server, distributed, or integrated into CI/CD pipelines) does not change the exposure; if the web interface is reachable, the vulnerability is exploitable.

Blast Radius: The CVSS vector indicates:

• Confidentiality (L): Limited data disclosure, but the actual impact depends on the sensitivity of files in the downloads directory.
• Integrity (N): No data modification is possible.
• Availability (L): Possible minor denial-of-service or resource exhaustion.

With an EPSS percentile of 35.7%, the exploitability is currently considered low but non-negligible. The E:P (Proof-of-concept code exists) component in the vector suggests that while no public exploit is confirmed, the attack technique is well-understood and weaponization is trivial — forced browsing only requires a simple HTTP client (e.g., curl or a browser). The lack of authentication requirements (PR:N) means any network-reachable attacker can exploit this without prior access.

The low patch confidence (2/4) is a concern. If the CNA's claim of a fix in version 2023.3.2 is accurate, organizations running earlier versions remain exposed. Enterprises that cannot immediately upgrade should treat all prior versions as vulnerable.

Detection Guidance

Sigma Rule

The following Sigma rule detects successful or attempted access to the Coverity downloads directory, which can be indicative of forced browsing behavior.

title: Forced Browsing Attempt Against Synopsys Coverity Downloads Directory
id: 3f6d9c44-6b71-4e85-9c2a-c26e0dfa5118
status: experimental
description: Detects HTTP requests to the Coverity downloads directory, potentially indicating CVE-2023-1663 exploitation attempts.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-1663
tags:
    - attack.discovery
    - attack.t1083
    - cve.2023.1663
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-path|contains:
            - '/downloads'
            - '/downloads/'
    condition: selection
falsepositives:
    - Legitimate internal user downloads from the Coverity server
level: medium

YARA Rule

This YARA rule is designed to detect HTTP responses containing Coverity-specific download directory paths, which can be used to identify compromised hosts or traffic captures containing exploitation attempts.

rule CVE_2023_1663_Coverity_Forced_Browsing {
    meta:
        author = "Valter Sit Threat Intelligence"
        description = "Detects HTTP response bodies or network captures containing Coverity downloads directory references"
        cve = "CVE-2023-1663"
        date = "2025-04-10"
        severity = "medium"
    strings:
        $s1 = "/downloads/" ascii wide nocase
        $s2 = "Coverity" ascii wide nocase
        $s3 = "Content-Disposition: attachment" ascii wide nocase
    condition:
        ($s1 and $s2) or ($s1 and $s3)
}

Suricata IDS Rule

This Suricata rule monitors HTTP traffic for requests targeting the Coverity downloads directory without prior authentication, which may indicate exploitation.

alert http any any -> $HOME_NET any (msg:"CVE-2023-1663 - Possible Forced Browsing of Coverity Downloads Directory"; flow:to_server,established; http.uri; content:"/downloads/"; http.method; content:"GET"; classtype:attempted-recon; sid:20231663; rev:1;)

Note: This rule may generate false positives for legitimate unauthenticated downloads. Adjust $HOME_NET and add source IP allowlists as needed.

Elastic Detection

The following Elastic EQL query detects successful access to the Coverity downloads directory in HTTP server logs.

configuration where event.category == "web" and process.name == "httpd" or process.name == "tomcat"
| where http.request.path like "*/downloads/*" and http.request.method == "GET"
| where not source.ip in ("127.0.0.1", "::1")

Alternatively, for a broader detection of unauthenticated access attempts:

any where event.category == "web" and http.request.path like "*/downloads*" and not user.name == "admin"

Splunk SPL Query

The following Splunk search queries web access logs for requests to the Coverity downloads directory from non-local IP addresses.

index=weblogs sourcetype=access_combined uri_path="/downloads/*" 
| where NOT clientip IN ("127.0.0.1", "::1", "10.0.0.0/8", "192.168.0.0/16") 
| stats count by clientip, uri_path, status, user 
| sort - count

For real-time alerting:

index=weblogs sourcetype=access_combined uri_path="/downloads/*" 
| rename src_ip as clientip 
| eval is_internal = if(cidrmatch("10.0.0.0/8", clientip) OR cidrmatch("192.168.0.0/16", clientip), 1, 0) 
| where is_internal == 0 
| table _time, clientip, uri_path, status, bytes

Wazuh OSSEC Rule

This Wazuh rule detects suspicious access patterns to the Coverity downloads directory in Apache access logs.

<group name="web,">
  <rule id="973340" level="8">
    <decoded_as>apache</decoded_as>
    <match>/downloads/</match>
    <regex>(\S+) - - \[[^\]]+\] "[A-Z]+ /downloads/[^\s"]+</regex>
    <description>Possible forced browsing attempt against Coverity downloads directory (CVE-2023-1663)</description>
    <mitre>
      <id>T1083</id>
    </mitre>
    <group>web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED — single source claims patch (not independently confirmed).

1) Immediate Mitigations (if patching is not immediately possible)

• Restrict network access: Apply network-level access control lists (ACLs) or firewall rules to limit access to the Coverity web interface to trusted internal IP ranges only. If possible, place the Coverity server on a segregated network segment with no inbound internet exposure.
• Disable or protect the downloads directory: If the misconfiguration can be identified, remove or correct the servlet mapping that exposes the downloads directory. Consult the Apache Tomcat documentation for the correct way to map static resources and restrict access to directories that should not be publicly served.
• Enable authentication at the proxy/reverse proxy layer: If Coverity is fronted by a reverse proxy (e.g., Nginx or Apache HTTP Server), enforce authentication at the proxy level so that requests to /downloads/* require credentials before being forwarded to the Tomcat backend.
• Monitor logs: Deploy the detection rules above (Sigma, Suricata, Splunk, etc.) to identify and respond to any access attempts in real time.

2) Patch / Upgrade Steps

• Recommended action: Upgrade to Coverity version 2023.3.2 or later. According to the CNA, this version resolves the vulnerability by correcting the servlet mapping configuration.
• Verification: Since patch confidence is 2/4 (single-source claim), validate the fix after upgrading by attempting to access the /downloads/ path without authentication. If the directory is no longer accessible, the patch has been successfully applied.
• Beware of implementation differences: If your deployment uses a custom servlet mapping or web application configuration, confirm that the upgrade preserves your customizations and does not reintroduce the issue.

3) Long-Term Hardening

• Standardize Tomcat configuration: Develop and maintain a hardened baseline for Apache Tomcat configurations, including least-privilege servlet mappings, disabled directory listing, and proper authentication requirements for all application resources.
• Regular security assessments: Include the Coverity web application in periodic penetration tests and vulnerability scans. Since forced browsing is a commonly missed vulnerability class, ensure testers specifically probe for exposed file paths and unauthenticated resource access.
• Update processes: Ensure that all third-party components (including the embedded Apache Tomcat) are on supported versions and tracked for relevant CVEs.
• Vendor engagement: Contact Synopsys support to confirm the patch and inquire about any supplemental advisories or recommended configuration changes.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-1663
2. Synopsys Product Security (vendor advisory): https://www.synopsys.com/software-integrity/security-advisories.html (search for CVE-2023-1663)
3. MITRE ATT&CK — T1083 File and Directory Discovery: https://attack.mitre.org/techniques/T1083/
4. OWASP Forced Browsing Threat Description: https://owasp.org/www-community/attacks/Forced_browsing
5. CISA Known Exploited Vulnerabilities Catalog (for verification that this CVE is NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns / Exploitation in the Wild: As of this writing, no public evidence of active exploitation or threat actor campaigns targeting this CVE has been identified. The CVE is not listed in CISA KEV, indicating no confirmed in-the-wild exploitation has been reported to CISA.