pysec-2021-17
Vulnerability from pysec
Published
2021-05-05 11:15
Modified
2021-09-01 08:19
Details

Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22. An attacker that connects to a running smbserver instance can list and write to arbitrary files via ../ directory traversal. This could potentially be abused to achieve arbitrary code execution by replacing /etc/shadow or an SSH authorized key.

Impacted products
Name purl
impacket pkg:pypi/impacket
Aliases


To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "impacket",
        "purl": "pkg:pypi/impacket"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "49c643bf66620646884ed141c94e5fdd85bcdd2f"
            }
          ],
          "repo": "https://github.com/SecureAuthCorp/impacket",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0.9.10"
            },
            {
              "fixed": "0.9.23"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.9.10",
        "0.9.11",
        "0.9.12",
        "0.9.13",
        "0.9.14",
        "0.9.15",
        "0.9.17",
        "0.9.18",
        "0.9.19",
        "0.9.20",
        "0.9.21",
        "0.9.22"
      ]
    }
  ],
  "aliases": [
    "CVE-2021-31800",
    "GHSA-mj63-64x7-57xf"
  ],
  "details": "Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22. An attacker that connects to a running smbserver instance can list and write to arbitrary files via ../ directory traversal. This could potentially be abused to achieve arbitrary code execution by replacing /etc/shadow or an SSH authorized key.",
  "id": "PYSEC-2021-17",
  "modified": "2021-09-01T08:19:03.897095Z",
  "published": "2021-05-05T11:15:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/SecureAuthCorp/impacket/blob/cb6d43a677c338db930bc4e9161620832c1ec624/impacket/smbserver.py#L2008"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SecureAuthCorp/impacket/releases"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SecureAuthCorp/impacket/blob/cb6d43a677c338db930bc4e9161620832c1ec624/impacket/smbserver.py#L876"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SecureAuthCorp/impacket/blob/cb6d43a677c338db930bc4e9161620832c1ec624/impacket/smbserver.py#L2958"
    },
    {
      "type": "FIX",
      "url": "https://github.com/SecureAuthCorp/impacket/commit/49c643bf66620646884ed141c94e5fdd85bcdd2f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SecureAuthCorp/impacket/blob/cb6d43a677c338db930bc4e9161620832c1ec624/impacket/smbserver.py#L3485"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UF56LYB27LHEIFJTFHU3M75NMNNK2SCG/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPXDPWCAPVX3UWYZ3N2T5OLBSBBUHJP6/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KRV2C5DATXBHG6TF6CEEX54KZ75THQS3/"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-mj63-64x7-57xf"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.