CVE-2023-43801

Description

### Impact The vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP DELETE request. Further details are available in the references. ### Fixed Version * `1.3.3` ### References The issue was reported by Nozomi Networks Labs. Further details on the issue are available at the following URL: * https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide

How to fix CVE-2023-43801

To remediate CVE-2023-43801, upgrade the affected package to a fixed version below.

• —upgrade to 1.3.3 or later

Is CVE-2023-43801 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 1.3.3

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-43801
• PATCHgithub.com/arduino/arduino-create-agent
• WEBgithub.com/arduino/arduino-create-agent/releases/tag/1.3.3
• WEBgithub.com/arduino/arduino-create-agent/security/advisories/GHSA-mjq6-pv9c-qppq