CVE-2023-27577

Executive Summary

CVE-2023-27577 is a path traversal vulnerability in the LESS parser component of Flarum, a widely deployed open-source forum software package, affecting all versions prior to 1.7.0. The vulnerability allows an attacker who has already compromised an administrative account to read sensitive files from the server filesystem by supplying an absolute path in the custom LESS setting. The issue is rated with a CVSS score of 6.6 (HIGH severity) and carries a low EPSS score of 0.00851, suggesting limited active exploitation in the wild. The vendor has addressed the vulnerability in Flarum version 1.7.0, and a patch exists with high confidence (3/4).

Technical Analysis

The vulnerability resides in the integration between Flarum's custom theme/LESS configuration subsystem and the underlying LESS CSS preprocessor. Flarum, being a community forum platform, allows administrators to customize the appearance of their forums using LESS — a dynamic stylesheet language that extends CSS with variables, mixins, and functions. This customization is performed through an administrative interface where the administrator can define custom LESS code.

The LESS preprocessor, when compiling LESS into CSS, supports the @import directive. This directive is designed to include external LESS files into the compilation stream. Critically, the LESS parser resolves the path parameters of the @import directive against the server's filesystem. In an insecure configuration, the parser does not restrict what files can be imported — it will happily import any file the process has read access to, regardless of whether that file is an actual LESS/CSS stylesheet or an arbitrary sensitive file on the server.

The attack mechanism works as follows: an attacker with access to a compromised admin account navigates to the custom LESS settings panel. In the LESS input field, the attacker embeds an @import statement that points to an absolute file path on the server, such as /etc/passwd. When the LESS compilation is triggered (e.g., by saving the settings or when the forum regenerates its compiled CSS), the LESS parser reads the target file. The contents of that file then become part of the generated CSS output. Since the generated CSS is cached and served to all visitors of the forum, the attacker (and any unauthenticated user) can retrieve the file contents by viewing the forum's source code or requesting the compiled CSS asset.

It is important to note several boundary conditions of this vulnerability:

• Pre-authentication requirement: The attacker must first compromise an administrative account. The NVD description explicitly notes this is an "admin account which has already been compromised," categorizing this as a privilege-escalation-to-information-disclosure scenario rather than an unauthenticated attack.
• Filesystem reachability: The scope of files accessible depends entirely on the operating system permissions granted to the user account running the Flarum web server process (e.g., www-data, nginx, or apache user on Linux systems).
• Arbitrary code execution not achieved: This vulnerability is limited to file read (information disclosure). It does not allow arbitrary code execution, file write, or direct shell access — though reading configuration files (e.g., database credentials, application secrets) could enable further lateral movement within the server.

The NVD description explicitly demonstrates the attack vector: "an attacker could use the following code to read the contents of the /etc/passwd file on a linux machine." The example code would be a LESS import directive pointing to the absolute path. Because the parser accepts absolute paths, path traversal beyond the application root is trivially achievable, sidestepping the need for traditional ../ traversal sequences.

Insufficient technical detail is available to enumerate the exact LESS parser version, the specific configuration flag that should have been enforced upstream, or the precise method by which Flarum invokes the compiler. However, the vulnerability class is well understood: insufficient input sanitization and path restriction in an embedded preprocessor.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is confirmed available. The following attack chain is inferred from the CVE description and the known vulnerability class.

Step 1 — Reconnaissance / Target Identification. The attacker identifies a Flarum forum as a target. On the forum, the attacker fingerprints the software version (e.g., via the meta generator tag in the HTML, the /api endpoint, or the version string embedded in static assets). The attacker then determines whether the version is prior to 1.7.0, confirming suspected vulnerability.

Step 2 — Privilege Acquisition. The attacker must obtain administrative credentials. This is outside the scope of CVE-2023-27577 itself but can be achieved through credential phishing, brute force (if weak passwords are used), password reuse against the forum's admin account, or by exploiting a separate vulnerability. The NVD description explicitly assumes "an admin account which has already been compromised by an attacker."

Step 3 — Triggering the Flaw. The attacker logs into the Flarum admin panel and navigates to the Appearance/Styles settings section where custom LESS code can be entered. In the LESS editor field, the attacker enters a LESS import directive that references an absolute file path. For instance, the attacker might enter a directive equivalent to @import (inline) "/etc/passwd"; — though the precise syntax depends on the LESS version, the concept is importing a sensitive file by absolute path. Upon saving the settings, Flarum triggers the LESS compilation process.

Step 4 — Exfiltration / Post-Exploitation. The LESS parser reads /etc/passwd (or any other readable file) and embeds its raw content into the compiled CSS output. The attacker then either:

• Accesses the compiled CSS file directly via the browser's developer tools (viewing the network response of the CSS asset), or
• Views the forum's page source and inspects the embedded @import content, or
• Requests the compiled CSS URL directly.

The attacker can repeat this process to exfiltrate multiple files, mapping out the filesystem and extracting sensitive data. Examples of high-value targets include: web server configuration files (e.g., Apache/nginx virtual host configs), application configuration files containing database credentials and secret keys, SSH keys, and other forum data. Post-exploitation impact is amplified because the attacker can read any file accessible to the web server process, including files that may facilitate lateral movement and full server compromise.

Impact Assessment

Business Impact: CVE-2023-27577 exposes sensitive configuration data and potentially user data from the server filesystem. Successful exploitation leads to a confidentiality breach that can result in:

• Exposure of database credentials and application secret keys, potentially leading to database compromise and data breaches of forum user records (email addresses, hashed passwords, private messages).
• Disclosure of server configuration files, which can be used to map the internal network and identify additional attack surfaces.
• Exposure of operational secrets that can facilitate further persistent access.

Affected Systems: All self-hosted Flarum installations running versions prior to 1.7.0. This includes Flarum instances on shared hosting, VPS, and dedicated infrastructure. Managed Flarum cloud services that update backend versions cannot be used as targets unless they expose version information indicating a vulnerable state.

Blast Radius: The CVSS vector places this at a base score of 6.6 (High severity) with the following subscores:

• Attack Vector (AV:N): The exploitation is performed over the network through the web application interface.
• Attack Complexity (AC:H): The attacker must have already compromised an admin account (high complexity) — this is not a trivial unauthenticated exploit.
• Privileges Required (PR:H): Administrative privileges are required.
• User Interaction (UI:N): No user interaction is required beyond the attacker's own actions.
• Confidentiality Impact (C:H): Complete loss of confidentiality for files readable by the web server process.
• Integrity Impact (I:N): No direct integrity impact — files are read, not modified.
• Availability Impact (A:N): No direct denial-of-service.

Additional risk factors include:

• EPSS = 0.00851 (55th percentile): Low probability of exploitation in the wild, but the elevated percentile signals observable interest in the vulnerability.
• CISA KEV Status: No — Not currently noted as exploited-in-the-wild by CISA's Known Exploited Vulnerabilities catalog.

Despite the high privilege requirement, the severity remains elevated because forum administrators frequently reuse credentials across accounts, making compromise of admin accounts a realistic attack vector in targeted campaigns.

Detection Guidance

Sigma Rule

title: Flarum LESS Path Traversal - Server File Read Attempt
id: 9f3c1b7a-4c2e-4d9a-8e4f-2a7b3c5d6e7f
status: experimental
description: Detects attempts to exploit CVE-2023-27577 by injecting LESS import directives referencing sensitive file paths via Flarum admin API requests.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27577
author: Valtersit Threat Intelligence
date: 2024/12/01
logsource:
    category: webserver
    product: nginx
    service: http
detection:
    selection_admin_api:
        http.url|contains:
            - '/api/settings'
            - '/admin/packages'
    selection_less_payload:
        http.request_body|contains|all:
            - 'less'
            - '@import'
        http.request_body|re:
            - '\/etc\/passwd'
            - '\/etc\/shadow'
            - '\/etc\/ssh\/'
            - '\/proc\/self\/environ'
            - '\/\.ssh\/'
            - '\/\.env'
            - 'file:\/\/\/'
            - '\{\.\/\}\.\/\.\.\/'
    selection_admin_method:
        http.method: 'POST'
    condition: selection_admin_api and selection_less_payload and selection_admin_method
level: high
falsepositives:
    - Legitimate LESS imports of user-defined theme files (rare, typically use relative paths, not absolute system paths)
fields:
    - src_ip
    - http.url
    - http.request_body
    - user
tags:
    - attack.t1083
    - attack.t1190
    - cve.2023-27577

Explanation: This Sigma rule monitors POST requests to Flarum's settings/admin API endpoints for request bodies containing LESS import directives combined with absolute paths to sensitive system files. The regex patterns cover common Linux sensitive files and path traversal patterns.

YARA Rule

rule Flarum_LESS_PathTraversal_SensitiveFileKeywords {
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2024-12-01"
        description = "Detects suspicious LESS import directives referencing sensitive system files in requests or logs"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-27577"
        version = "1.0"
    strings:
        $import = "@import" nocase
        $paswd = "/etc/passwd" nocase
        $shadow = "/etc/shadow" nocase
        $group = "/etc/group" nocase
        $hosts = "/etc/hosts" nocase
        $ssh = "/home/*/.ssh/" nocase
        $ssl = "/etc/ssl/" nocase
        $nginx = "/etc/nginx/" nocase
        $apache = "/etc/apache/" nocase
        $proc = "/proc/self/" nocase
        $env = "/.env" nocase
        $root = "/root/" nocase
        $abs_path = /\/[a-zA-Z_\/]{2,}\.(conf|cfg|key|pem|crt|env|htpasswd|bash_history)/
    condition:
        $import and any of ($paswd,$shadow,$group,$hosts,$ssh,$ssl,$nginx,$apache,$proc,$env,$root) or
        ($import and $abs_path)
}

Explanation: This YARA rule detects arbitrary data containing LESS @import directives combined with well-known sensitive file paths or absolute paths to configuration files. Useful for scanning server logs, captured HTTP traffic, or cached request bodies for exfiltration attempts.

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2023-27577 Possible Flarum LESS Path Traversal - /etc/passwd Import"; flow:established,to_server; http.method; content:"POST"; http.url; content:"/api/"; http.client_body; content:"@import"; distance:0; http.client_body; content:"/etc/passwd"; distance:0; classtype:attempted-user; sid:2757701; rev:1; reference:cve,2023-27577; reference:url,nvd.nist.gov/vuln/detail/CVE-2023-27577; metadata:attack_target_server, created_at_2024_12_01, deployment_perimeter, signature_severity_major, tag_admin_exploit, tag_web_application)

alert http any any -> $HOME_NET any (msg:"CVE-2023-27577 Possible Flarum LESS Path Traversal - Sensitive File Import"; flow:established,to_server; http.client_body; content:"@import"; http.client_body; content:".env"; http.client_body; content:"ssh"; classtype:attempted-user; sid:2757702; rev:1; reference:cve,2023-27577; reference:url,nvd.nist.gov/vuln/detail/CVE-2023-27577; metadata:attack_target_server, created_at_2024_12_01, deployment_perimeter, signature_severity_major, tag_admin_exploit, tag_web_application)

alert http any any -> $HOME_NET any (msg:"CVE-2023-27577 Possible Flarum LESS Path Traversal - Absolute Path Import"; flow:established,to_server; http.client_body; content:"@import"; http.client_body; pcre:"/(\/etc\/|\/root\/|\/home\/|\/var\/www\/html\/)/"; classtype:attempted-user; sid:2757703; rev:1; reference:cve,2023-27577; reference:url,nvd.nist.gov/vuln/detail/CVE-2023-27577; metadata:attack_target_server, created_at_2024_12_01, deployment_perimeter, signature_severity_major, tag_admin_exploit, tag_web_application)

Explanation: These Suricata rules inspect HTTP POST request bodies for LESS @import directives combined with known sensitive file paths. The first rule targets the canonical /etc/passwd example; the second adds .env and SSH key patterns; the third matches any absolute Linux system path. Adjust $HOME_NET to your web server address as needed.

Elastic Detection

sequence by source.ip
  [ network where event.category == "http" and http.request.method == "POST"
    and http.request.body.content : "*@import*" 
    and http.request.body.content : ("*/etc/passwd*", "*/etc/shadow*", "*/etc/group*", 
                                      "*/.ssh/*", "*/.env*", "*/var/www/*", "*/root/*") ]
  [ process where event.category == "process" and process.name : "node" 
    and process.args : ("*less*", "*flarum*") 
    and process.args : ("*compile*", "*build*", "*cache*") ]

Explanation: This EQL sequence correlates HTTP requests that appear to contain LESS path traversal payloads with subsequent Node.js LESS compilation processes spawned on the server. The process correlation provides confirmation that the malicious LESS input actually triggered the compilation pipeline. Adjust the process name to match the Flarum runtime environment (PHP-FPM instead of Node.js in some deployments).

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
| where like(method, "POST")
  AND (like(uri, "%/api/%"))
  AND (like(form_data, "%@import%"))
  AND (like(form_data, "%/etc/") OR like(form_data, "%/root/") OR like(form_data, "%/home/")
       OR like(form_data, "%.env%") OR like(form_data, "%shadow%") OR like(form_data, "%ssh%"))
| eval attacker_ip = src_ip
| eval endpoint = uri
| eval malicious_payload = form_data
| table _time, attacker_ip, src_ip, endpoint, method, status, malicious_payload
| sort - _time
| eval threat_name = "CVE-2023-27577 Flarum LESS Path Traversal"
| search threat_name="*"

Explanation: This SPL query searches web access/application logs for POST requests to Flarum API endpoints containing LESS import directives and references to sensitive file paths. It triggers on the key differentiators of the attack: admin-level API access (compromised account) combined with absolute path reference to sensitive system files.

Wazuh OSSEC Rule

<group name="web_application,">
  <rule id="275770" level="12">
    <decoded_as>web</decoded_as>
    <field name="method">POST</field>
    <field name="url">\./api/</field>
    <description>Flarum CVE-2023-27577: LESS path traversal attempt - /etc/passwd import via admin API</description>
    <url>https://nvd.nist.gov/vuln/detail/CVE-2023-27577</url>
    <regex>@import\s+.*?["']?\/etc\/passwd</regex>
    <group>web_application,attack,t1083,t1190,cve_2023_27577</group>
    <mitre>
      <id>T1083</id>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="275771" level="12">
    <decoded_as>web</decoded_as>
    <field name="method">POST</field>
    <field name="url">\./api/</field>
    <description>Flarum CVE-2023-27577: LESS path traversal attempt - sensitive system path import</description>
    <url>https://nvd.nist.gov/vuln/detail/CVE-2023-27577</url>
    <regex>@import\s+.*?["']?(?:\/etc\/|\/root\/|\/home\/|\/var\/www\/).*?(?:\.env|\.conf|\.key|\.pem|\.crt|\.htpasswd|bash_history)</regex>
    <group>web_application,attack,t1083,t1190,cve_2023_27577</group>
    <mitre>
      <id>T1083</id>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Explanation: These Wazuh rules decode web server access logs (via the web decoder) and match POST requests to /api/ endpoints that contain LESS import directives pointing to /etc/passwd (rule 275770) or other sensitive system paths with known sensitive file extensions (rule 275771). Level 12 indicates a high-severity active attack.

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY) — The fix is confirmed by two independent sources (CNA and OSV), validating that version 1.7.0 resolves the underlying LESS parser path traversal issue.

Immediate Mitigations (if immediate upgrade is not possible)

1. Harden Administrative Accounts (Required): Since exploitation requires a compromised admin account, enforce mandatory multi-factor authentication (MFA) on all Flarum admin accounts immediately. This is the single most impactful mitigating control.
2. Enforce Strong Password Policy: Require long, complex, unique passwords for all administrative accounts. Enforce regular password rotation and prohibit password reuse across other services.
3. Operating System File Permissions: Run the Flarum web server process under a dedicated low-privilege user (e.g., www-data, nginx). Ensure this user does not have read access to /etc/shadow, /root/, SSH keys, application code repositories, or sensitive configuration files outside the web root. Audit existing permissions — the NVD description notes the exposure scope is "dependant on the permissions given to the running flarum process."
4. Web Application Firewall Rules: Deploy WAF rules that block POST requests to the Flarum /api/ endpoints containing @import followed by absolute paths (starting with /) or file:// protocol. Use the Suricata/Sigma rules above as references.
5. Least Privilege Filesystem Mounts: On Linux, consider bind-mounting sensitive directories (/etc, /var/www/html) as read-only to the container/VPS environment, or use AppArmor/SELinux to restrict filesystem read access for the web server process.

Patch / Upgrade Steps

1. Update to Flarum 1.7.0 or later — this is the canonical fix.
   • Backup the current Flarum installation (database, /config.php, /flarum, /vendor, and /public/assets).
   • In the Flarum root directory, run: php flarum update (or follow the standard Flarum upgrade guide from the official documentation).
   • Verify the composer.json was updated to "flarum/core": "^1.7.0".
   • Clear all application caches: php flarum cache:clear and php flarum assets:publish.
   • After upgrade, verify from the admin panel that the custom LESS editor no longer accepts absolute paths or that a middleware blocks such imports.
2. Verify patch with an internal test: In a staging environment, attempt to enter a LESS import with an absolute path like /etc/passwd in the custom LESS field. Verify that compilation fails or blocks the import.

Long-Term Hardening

1. Access Control / Audit Logging: Enable and monitor audit logging for all admin panel actions. Flag any changes to Appearance/LESS settings from unexpected IP addresses or during unusual time windows. Review logins from priviledged accounts.
2. Application Isolation: Deploy Flarum in a containerized environment (Docker, LXC) with read-only root filesystem and a hardened seccomp profile. Restrict the container privileges so even full file read is limited in blast radius.
3. Regular Patching Cadence: Subscribe to Flarum security advisories and apply all security updates within an acceptable time window (e.g., 72 hours for critical severity).
4. Credential Hygiene: Implement an organization-wide password manager for administrator accounts. Mandate MFA for all admin users — this is the strongest control against the "compromised admin" pre-condition.
5. Network Segmentation: Place the Flarum web application in a segmented zone with egress filtering, preventing any exfiltrated data from reaching external systems directly.
6. Vulnerability Scanning: Add Flarum version detection and CVE-2023-27577 checks to the organization's automated vulnerability management program. Re-scan quarterly.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-27577 — Official NVD record with NVD description, CVSS score, and reference links.
2. Flarum GitHub Advisories / Release Notes: https://github.com/flarum/framework — Release notes for version 1.7.0 and security advisory details (confirmed by CNA and OSV sources).
3. OSV Advisory Database: https://osv.dev/vulnerability/CVE-2023-27577 — Independent confirmation of the fix, package metadata, and affected version ranges.
4. CWE-22 Reference (Path Traversal): https://cwe.mitre.org/data/definitions/22.html — For context on the vulnerability class, even though exact CWE assignment was not provided in the CVE data.
5. MITRE ATT&CK Technique T1083 (File and Directory Discovery): https://attack.mitre.org/techniques/T1083/ — Reference for the MITRE tactic mapping used in this report.

Threat Actor / In-the-Wild Evidence: At the time of this report, there is no confirmed threat actor campaign, exploit-in-the-wild evidence, or CISA KEV listing associated with CVE-2023-27577. The low EPSS score (0.00851, 55th percentile) and absence of public PoC code suggest the vulnerability is not yet a target for widespread automated exploitation. However, since it is a known issue with a documented fix, active exploitation by targeted attackers against high-value Flarum forums remains a plausible scenario. Organizations running vulnerable Flarum instances should prioritize patching regardless of the lack of observed in-the-wild activity.