CVE-2023-43802

Executive Summary

CVE-2023-43802 is a path traversal vulnerability in the Arduino Create Agent, a background service that facilitates communication between the Arduino IDE and connected development boards. The flaw resides in the HTTP endpoint /upload, where the filename parameter is insufficiently sanitized. A local or remote attacker who can issue HTTP requests to the agent's localhost interface (or bypass CORS restrictions) can exploit this to write arbitrary files to the filesystem with the privileges of the user running the agent, leading to privilege escalation and potential remote code execution. The issue is fixed in version 1.3.3; no workarounds are available. Given the agent typically runs with elevated permissions on development workstations, exploitation could grant an attacker persistent code execution on the host.

Technical Analysis

Vulnerability Mechanism: The Arduino Create Agent exposes an HTTP service on the localhost interface (typically bound to 127.0.0.1 on a fixed port) to accept file uploads and commands from the Arduino IDE and web editor. The vulnerable endpoint /upload accepts a filename parameter that determines where an uploaded file will be written on disk. The parameter is not sufficiently validated against path traversal sequences (e.g., ../). By crafting a filename value that includes directory traversal payloads such as ../../../../../../etc/cron.d/backdoor, an attacker can write content outside the intended upload directory, into arbitrary locations on the filesystem.

Attack Surface: The agent listens on the loopback interface, meaning any user or process on the same host can reach it. Additionally, the agent's web interface is CORS-enabled to allow the Arduino web editor to communicate with it. If the CORS configuration is overly permissive or can be bypassed (e.g., via DNS rebinding or browser-level vulnerabilities), a malicious website visited in the victim's browser could also trigger requests to the agent, enabling a drive-by-style attack from the internet.

Code-Level Perspective: The NVD description identifies the POST /upload endpoint and filename parameter explicitly. No other nonce, token, or authentication mechanism is mentioned, suggesting the endpoint may rely solely on the host-based trust model (i.e., "only local processes can reach it"). The fix, introduced in version 1.3.3, presumably adds canonicalization or rejection of traversal sequences in the filename handling. The agent runs with the privileges of the logged-in user. On typical developer machines, this user has administrative rights (or sudo ability), making the write primitive effectively a privilege escalation to a highly privileged account.

Related Weakness: This is a classic arbitrary file write vulnerability in a local web service. It is similar in spirit to path traversal issues found in other development tools (e.g., GitHub's git-lfs, various package managers) that expose localhost services. The impact is amplified by the service's persistence and integration with the OS-level file system.

Exploitation Scenarios

Attack Scenario 1 — Local Privilege Escalation (Primary):

1. Reconnaissance: An attacker with a low-privileged shell on the target machine enumerates listening ports with netstat or ss, discovering an agent bound to a high port on 127.0.0.1 (commonly port 8991, though not dislcosed in the CVE). They probe the root path and discover the /upload endpoint.
2. Trigger: The attacker crafts an HTTP POST request to http://127.0.0.1:<port>/upload with a multipart body or URL-encoded parameter where filename contains a traversal sequence.
3. Payload Execution: The attacker writes a file to a location that results in code execution at the agent's privilege level. Example targets:
   • On Linux: writing to /etc/cron.d/ to spawn a reverse shell, or writing to ~/.bashrc / ~/.profile for the target user.
   • On Windows: writing to C:\Users\<victim>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\. The content of the file is the body of the POST request, so the attacker can upload a full cron job or executable script.
4. Post-exploitation: Once the malicious file is triggered (e.g., next cron tick or next user login), the attacker gains a shell or executes commands as the agent owner — typically the admin-level user. From there, they can pivot, extract credentials, and move laterally.

Attack Scenario 2 — Remote Drive-By via CORS Bypass:

1. Reconnaissance: The attacker hosts a malicious website. They either know the agent's default port or perform a port scan through a browser (noting that browsers cannot scan arbitrary ports, but the agent's CORS policy may permit requests from any origin).
2. Trigger: The victim visits the malicious page. The page makes an AJAX POST to http://127.0.0.1:<port>/upload with filename=../../../../../../../tmp/backdoor and a payload body containing a cron job or shell script.
3. Payload Execution: If the CORS policy is Access-Control-Allow-Origin: * (or a bypass exists via null origin), the browser executes the request. The write succeeds.
4. Post-exploitation: As above, the attacker achieves code execution upon the next user login or cron execution. This scenario exploits the "remote-to-local" trust boundary, turning a web browsing session into a full system compromise.

Attack Scenario 3 — Supply Chain Staging: A malicious actor could silently replace files in the Arduino installation directory (if the agent runs from an unprotected location) to inject malicious code into the user's development environment. Since the agent writes files on behalf of the user, it could overwrite core IDE libraries or configuration files, leading to code injection into future compiled sketches.

Note: No public PoC has been identified at the time of writing. The attack chain above is inferred from the vulnerability class (arbitrary file write via path traversal) and the endpoint details provided in the NVD description.

Impact Assessment

CVSS Analysis: The base score is 7.1 (High). The vector reflects a locally accessible service (AV:L), low attack complexity (AC:L), no privileges required (PR:N), and user interaction required (UI:R) — likely because the CORS-based vector requires the victim to visit a page. The scope is unchanged (S:U), but the confidentiality (C:H) and integrity (I:H) impacts are high, reflecting that an attacker can read/write arbitrary files as the service user. Availability (A:L) is low, as the attacker could also corrupt critical system files.

Business Impact: The Arduino Create Agent is deployed on the workstations of embedded engineers, IoT developers, and students. A successful exploit yields:

• Full control of the developer workstation — code theft, credential harvesting, keystroke logging.
• Code tampering — malicious firmware written to connected boards, potentially weaponizing IoT devices in the field.
• Supply chain poisoning — malicious payloads injected into shared code repositories if the compromised environment is used for development and pushing code.

Affected Systems: All installations of Arduino Create Agent before version 1.3.3 are vulnerable. This includes:

• Standalone agents bundled with the Arduino IDE (versions pre-2.2.x).
• Agents running as part of the Arduino Web Editor integration.
• Linux (deb/rpm), macOS (dmg), and Windows (installer) variants.
• CI environments and Docker containers that include the agent as a sidecar for build automation.

Blast Radius: The vulnerability is particularly dangerous in shared or multi-user environments where the agent runs with a shared admin account. In a CI/CD pipeline, an attacker who compromises a build agent can write to the pipeline runner's filesystem, potentially pivoting to other infrastructure. The lack of authentication on the endpoint amplifies the risk.

Detection Guidance

Sigma Rule

title: Arduino Create Agent - Path Traversal in /upload Endpoint
id: 3b0a58ad-9a2c-4f1e-9d3a-8e6f2c1b9b0a
status: experimental
description: Detects HTTP POST requests to /upload endpoint with path traversal sequences in the filename parameter
author: Valtersit SOC
logsource:
  category: webserver
  product: arduino_create_agent
detection:
  selection_upload:
    cs-method: POST
    cs-uri-path: /upload
  selection_traversal:
    c-uri-query|contains:
      - '../'
      - '..\\'
      - '%2e%2e/'
      - '%2e%2e%5c'
      - '..%2f'
      - '..%5c'
  condition: selection_upload and selection_traversal
fields:
  - src_ip
  - cs-uri-query
  - cs-host
  - c-useragent
falsepositives:
  - Legitimate file uploads with filenames containing dots (unlikely with ../ patterns)
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2023-43802

YARA Rule

rule Arduino_Create_Agent_Traversal_CVE_2023_43802 {
    meta:
        author = "Valtersit SOC"
        description = "Detects payload strings and HTTP requests exploiting path traversal in Arduino Create Agent /upload endpoint"
        cve = "CVE-2023-43802"
        date = "2024-05-01"
        score = 70

    strings:
        $traversal1 = "../" ascii nocase
        $traversal2 = "..\\" ascii nocase
        $traversal3 = "%2e%2e%2f" ascii nocase
        $traversal4 = "%2e%2e%5c" ascii nocase
        $traversal5 = "filename=" ascii nocase
        $traversal6 = "/upload" ascii nocase

    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A and
        any of ($traversal*) and
        ($traversal5 in (0..2048) or $traversal6 in (0..2048)) and
        filesize < 1MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2023-43802 - Arduino Create Agent Path Traversal via /upload"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/upload"; http.request_body; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c)/i"; classtype:attempted-admin; sid:20230438; rev:1; reference:cve,2023-43802; metadata:created_at 2024-05-01, updated_at 2024-05-01;)

Elastic Detection (EQL)

sequence by process.entity_id
  [network where destination.port == 8991 and protocol == "http" and  
     (message like "*POST*" and message like "*/upload*" and 
      message like "*../*" or message like "*..\\*" or 
      message like "*%2e%2e%2f*" or message like "*%2e%e%5c*")]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST"
| search uri_path="/upload"
| regex _raw "../|..\\\\|%2e%2e%2f|%2e%2e%5c"
| eval cve="CVE-2023-43802"
| table _time, src_ip, uri_path, uri_query, useragent, status

Wazuh OSSEC Rule

<rule id="202438" level="12">
  <if_sid>31100</if_sid> <!-- HTTP request rule -->
  <match>POST /upload</match>
  <regex>\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c</regex>
  <description>Potential CVE-2023-43802 Path Traversal attempt against Arduino Create Agent</description>
  <group>cve, arduino, path_traversal,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY). Two independent sources (CNA and OSV) confirm the fix exists in version 1.3.3. No workarounds are officially documented.

Immediate Mitigations:

1. Upgrade immediately to Arduino Create Agent version 1.3.3 or later. Verify the installed version with arduino-create-agent --version (if available) or check the installation directory.
2. Block external access: Ensure the agent's port is bound to 127.0.0.1 only. Use firewall rules to block any external interface from reaching the agent's listening port.
3. Harden CORS: If you use a reverse proxy or custom configuration, restrict Access-Control-Allow-Origin to the exact origin of the Arduino web editor (e.g., https://create.arduino.cc). DO NOT use wildcard *.
4. IDS/IPS monitoring: Deploy the detection rules above to alert on any traversal attempts, especially from processes not associated with the Arduino IDE.

Patch/Upgrade Steps:

• Windows: Download and run the latest installer from https://create.arduino.cc/agent or update via the Arduino IDE (Tools > Board > Boards Manager).
• macOS/Linux: If installed via package manager, run sudo apt update && sudo apt upgrade arduino-create-agent (Debian/Ubuntu) or the equivalent for your distro. Alternatively, download the latest binary from the official GitHub releases page.
• Docker/CI: Pull the latest image of any container that bundles the agent and rebuild.

Long-Term Hardening:

1. Least privilege: Run the Arduino Agent under a dedicated low-privileged service account rather than an admin user. If full admin access is required (e.g., for board flashing), restrict the account to the specific libraries/tools needed.
2. Network isolation: Isolate the agent from the general network. If used in a CI/CD pipeline, place it in a hardened container with no direct access to other sensitive infrastructure.
3. Local firewall: Configure host-based firewalls to deny all inbound connections to the agent's port except from trusted processes (e.g., the IDE executable).
4. Input validation review: After upgrading, audit the agent's configuration and logs for any signs of prior compromise. Check for unexpected files written to user directories or system directories.
5. Periodic vulnerability scanning: Include the agent in your regular port scan and CVE scan cadence. Register the agent version in your asset inventory.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-43802
2. Arduino Official Advisory: https://blog.arduino.cc/2023/09/28/security-advisory-arduino-create-agent-1-3-3/
3. OSV Advisory (Google): https://osv.dev/vulnerability/CVE-2023-43802
4. GitHub Release Notes (Agent 1.3.3): https://github.com/arduino/arduino-create-agent/releases/tag/1.3.3
5. CISA KEV Catalog: (Not listed — as of report date, CVE-2023-43802 is not in KEV.)

Threat Actor Activity: There are no known in-the-wild exploits or threat actor campaigns using this CVE at the time of writing. The EPSS score of 0.00354 (28.3rd percentile) indicates a low exploitation likelihood in the current threat environment, but the privilege escalation potential warrants proactive patching.