CVE-2023-33871: Iagona Scrutisweb Path Traversal Flaw

CVE-2023-33871 Overview

CVE-2023-33871 is a directory traversal vulnerability affecting Iagona ScrutisWeb versions 2.1.37 and prior. This vulnerability allows an unauthenticated attacker to directly access any file outside the webroot, potentially exposing sensitive system files and configuration data without requiring any authentication.

Critical Impact

Unauthenticated attackers can exploit this directory traversal flaw to read arbitrary files from the server, potentially accessing sensitive configuration files, credentials, and system data.

Affected Products

• Iagona ScrutisWeb versions 2.1.37 and prior

Discovery Timeline

• 2023-07-18 - CVE-2023-33871 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-33871

Vulnerability Analysis

This directory traversal vulnerability exists in Iagona ScrutisWeb, a web-based fleet management solution used for monitoring and managing ATMs and self-service devices. The flaw allows unauthenticated users to bypass normal access restrictions and retrieve files from arbitrary locations on the server's file system.

The vulnerability is particularly concerning because it requires no authentication and can be exploited remotely over the network. An attacker with network access to a vulnerable ScrutisWeb instance can craft requests containing path traversal sequences to access files outside the intended webroot directory.

Root Cause

The root cause of this vulnerability is improper input validation of user-supplied file paths. The application fails to properly sanitize path traversal sequences (such as ../ or URL-encoded equivalents) in file path parameters before processing them. This allows attackers to escape the webroot directory and access arbitrary files on the underlying file system.

Attack Vector

The attack vector for CVE-2023-33871 is network-based and requires no user interaction or authentication. An attacker can exploit this vulnerability by:

1. Identifying a vulnerable ScrutisWeb instance exposed to the network
2. Crafting HTTP requests containing path traversal sequences in file path parameters
3. Submitting requests to read sensitive files such as /etc/passwd, configuration files, or application credentials
4. Extracting confidential information that may be used for further attacks

The vulnerability allows reading files with the privileges of the web application process, potentially exposing database credentials, API keys, and other sensitive configuration data.

Detection Methods for CVE-2023-33871

Indicators of Compromise

• HTTP requests containing path traversal sequences such as ../, ..%2f, or ..%5c in URL parameters
• Unusual access patterns to the ScrutisWeb application from unexpected IP addresses
• Log entries showing attempts to access files outside the webroot directory
• Requests for common sensitive files like /etc/passwd, configuration files, or database credentials

Detection Strategies

• Monitor web server logs for requests containing directory traversal patterns
• Implement Web Application Firewall (WAF) rules to block path traversal attempts
• Use intrusion detection systems (IDS) with signatures for directory traversal attacks
• Enable verbose logging on ScrutisWeb instances to capture suspicious request patterns

Monitoring Recommendations

• Establish baseline traffic patterns for ScrutisWeb instances and alert on anomalies
• Monitor for unusual file read operations by the web application process
• Implement log aggregation and correlation to identify traversal attempts across multiple instances
• Review access logs regularly for reconnaissance activity targeting the application

How to Mitigate CVE-2023-33871

Immediate Actions Required

• Upgrade Iagona ScrutisWeb to a version newer than 2.1.37 that addresses this vulnerability
• Restrict network access to ScrutisWeb instances using firewall rules and network segmentation
• Deploy a Web Application Firewall (WAF) with path traversal protection rules
• Review server logs for evidence of exploitation attempts

Patch Information

Organizations should consult the CISA ICS Advisory ICSA-23-199-03 for detailed information about this vulnerability and remediation guidance. Contact Iagona directly for the latest patched version of ScrutisWeb that addresses CVE-2023-33871.

Workarounds

• Implement strict network segmentation to limit access to ScrutisWeb instances to authorized IP ranges only
• Deploy a reverse proxy or WAF in front of the application to filter malicious requests
• Disable direct internet exposure of ScrutisWeb instances where possible
• Apply principle of least privilege to the web application's file system permissions

# Example WAF rule to block common path traversal patterns
# Add to your reverse proxy or WAF configuration
# Block requests containing directory traversal sequences
SecRule REQUEST_URI "@rx (\.\./|\.\.%2f|\.\.%5c)" \
    "id:1001,phase:1,deny,status:403,msg:'Path Traversal Attempt Detected'"