Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the
    endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who
    has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS
    configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create
    Agent via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised
    to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-43803)

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3649 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3649-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Sean Whitton     November 08, 2023                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-urllib3     Version        : 1.24.1-1+deb10u2     CVE ID         : CVE-2023-43803     Debian Bug     : 1054226

    It was discovered that python-urllib3, a user-friendly HTTP client     library for Python, did not remove the HTTP request body when an HTTP     redirect response using status 301, 302, or 303 after the request had     its method changed from one that could accept a request body, like POST,     to GET, as required by the HTTP RFCs.  This could lead to information     disclosure.

    For Debian 10 buster, these problems have been fixed in version     1.24.1-1+deb10u2.

    We recommend that you upgrade your python-urllib3 packages.

    For the detailed security status of python-urllib3 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-urllib3

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
416745	SCA: security update for github.com/arduino/arduino-create-agent (GHSA-m5jc-r4gf-c6p8)	Tenable Cloud Security	SCA Checks	high
416745	SCA: security update for github.com/arduino/arduino-create-agent (GHSA-m5jc-r4gf-c6p8)	Tenable Self-Hosted Container Security	SCA Checks	high
185377	Debian dla-3649 : python-urllib3 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2023-43803

high

Tenable Plugins

high

high

high