Plattform
windows
Komponente
craftos2
Behoben in
2.8.4
CVE-2024-43395 describes a directory traversal vulnerability discovered in CraftOS-PC 2, a C++ rewrite of the ComputerCraft desktop port. This flaw allows unauthorized access to files on a Windows system by manipulating directory paths. The vulnerability affects versions of CraftOS-PC 2 up to and including 2.8.2, and a patch is available in version 2.8.3.
The impact of this vulnerability is significant, as it allows an attacker to read or potentially write to any file accessible by the CraftOS-PC process. This could include sensitive configuration files, user data, or even system files. Successful exploitation could lead to information disclosure, privilege escalation, or even remote code execution if the attacker can overwrite executable files. The ability to bypass file permission checks makes this a particularly concerning vulnerability, as it circumvents standard security controls.
This vulnerability was publicly disclosed on August 16, 2024. There are currently no known public exploits or active campaigns targeting this vulnerability. It is not listed on the CISA KEV catalog. The ease of exploitation, given the straightforward bypass technique, warrants careful attention and prompt patching.
Users of CraftOS-PC 2 on Windows systems are at risk, particularly those who have not yet upgraded to version 2.8.3. Shared hosting environments where CraftOS-PC 2 is deployed could be particularly vulnerable, as a compromise of one instance could potentially lead to the compromise of others.
• windows / supply-chain:
Get-Process | Where-Object {$_.ProcessName -like '*CraftOS-PC*'} | Select-Object Path, CommandLine• windows / supply-chain:
Get-ScheduledTask | Where-Object {$_.TaskName -like '*CraftOS-PC*'} | Select-Object Action• windows / supply-chain: Check Autoruns for entries related to CraftOS-PC that might indicate malicious modifications.
disclosure
Exploit-Status
EPSS
0.03% (10% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2024-43395 is to immediately upgrade CraftOS-PC 2 to version 2.8.3 or later. If upgrading is not immediately feasible, consider implementing a WAF rule or proxy configuration to block requests containing obfuscated '..' sequences. While not a complete solution, this can provide a temporary layer of defense. Monitor CraftOS-PC process activity for unusual file access patterns, particularly attempts to access files outside the intended computer folder. After upgrading, confirm the fix by attempting to access files outside the designated directory and verifying that access is denied.
Actualice CraftOS-PC a la versión 2.8.3 o superior. Esta versión contiene una corrección para la vulnerabilidad de escape del sistema de archivos. Descargue la última versión desde el sitio web oficial o desde el repositorio de GitHub.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2024-43395 is a directory traversal vulnerability affecting CraftOS-PC 2 on Windows, allowing attackers to access files without permission by manipulating directory paths.
You are affected if you are using CraftOS-PC 2 on Windows with a version equal to or less than 2.8.2.
Upgrade CraftOS-PC 2 to version 2.8.3 or later to patch the vulnerability. Consider stricter file access controls as an interim measure.
There is currently no indication of active exploitation campaigns, but the vulnerability's simplicity suggests potential for future exploitation.
Refer to the CraftOS-PC project's official website or GitHub repository for the latest advisory and release notes.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.