Vulnerability Description
Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22. An attacker that connects to a running smbserver instance can list and write to arbitrary files via ../ directory traversal. This could potentially be abused to achieve arbitrary code execution by replacing /etc/shadow or an SSH authorized key.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Secureauth | Impacket | <= 0.9.22 |
| Fedoraproject | Fedora | 32 |
Related Weaknesses (CWE)
References
- https://github.com/SecureAuthCorp/impacket/blob/cb6d43a677c338db930bc4e916162083Third Party Advisory
- https://github.com/SecureAuthCorp/impacket/blob/cb6d43a677c338db930bc4e916162083Third Party Advisory
- https://github.com/SecureAuthCorp/impacket/blob/cb6d43a677c338db930bc4e916162083Third Party Advisory
- https://github.com/SecureAuthCorp/impacket/blob/cb6d43a677c338db930bc4e916162083Third Party Advisory
- https://github.com/SecureAuthCorp/impacket/commit/49c643bf66620646884ed141c94e5fPatchThird Party Advisory
- https://github.com/SecureAuthCorp/impacket/releasesRelease NotesThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://github.com/SecureAuthCorp/impacket/blob/cb6d43a677c338db930bc4e916162083Third Party Advisory
- https://github.com/SecureAuthCorp/impacket/blob/cb6d43a677c338db930bc4e916162083Third Party Advisory
- https://github.com/SecureAuthCorp/impacket/blob/cb6d43a677c338db930bc4e916162083Third Party Advisory
- https://github.com/SecureAuthCorp/impacket/blob/cb6d43a677c338db930bc4e916162083Third Party Advisory
- https://github.com/SecureAuthCorp/impacket/commit/49c643bf66620646884ed141c94e5fPatchThird Party Advisory
- https://github.com/SecureAuthCorp/impacket/releasesRelease NotesThird Party Advisory
FAQ
What is CVE-2021-31800?
CVE-2021-31800 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22. An attacker that connects to a running smbserver instance can list and write to arbitrary files via ../ direct...
How severe is CVE-2021-31800?
CVE-2021-31800 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-31800?
Check the references section above for vendor advisories and patch information. Affected products include: Secureauth Impacket, Fedoraproject Fedora.