CVE-2023-33566

Unauthorized node injection vulnerability in ROS2 Foxy Fitzroy

• CVSS 8.0
• CWE-94: Improper Control of Generation of Code ('Code Injection')
• Authentication, Authorization, and Session Management
• Remote

An unauthorized node injection vulnerability has been identified in ROS2 Foxy Fitzroy versions where ROS_VERSION is 2 and ROS_PYTHON_VERSION is 3. This vulnerability could allow a malicious user to inject malicious ROS2 nodes into the system remotely. Once injected, these nodes could disrupt the normal operations of the system or cause other potentially harmful behavior.

CVE

CVE-2023-33566

CWE

CWE-94: Improper Control of Generation of Code ('Code Injection')

CVSS base score

8.0

Published

2023-06-27

OWASP

A03 Injection

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update to ROS2 Foxy Fitzroy version 2.0.10 or higher

import rclpy
from rclpy.node import Node

class Node(Node):
    def __init__(self):
        super().__init__('node')

    def create_node(self, node_name):
        return rclpy.create_node(node_name)

def main(args=None):
    rclpy.init(args=args)
    node = Node()
    
    new_node = node.create_node('node')

    rclpy.spin(node)
    node.destroy_node()
    rclpy.shutdown()

if __name__ == '__main__':
    main()

import rclpy
from rclpy.node import Node

class Node(Node):
    def __init__(self):
        super().__init__('node')

    def validate_node_name(self, node_name):
        allowed_node_names = ['node', 'trusted_node']
        if node_name not in allowed_node_names:
            raise ValueError(f"Unauthorized node name: {node_name}")

    def create_node(self, node_name):
        self.validate_node_name(node_name)
        return rclpy.create_node(node_name)

def main(args=None):
    rclpy.init(args=args)
    node = Node()
    
    try:
        new_node = node.create_node('node')
    except ValueError as e:
        node.get_logger().error(str(e))
    
    rclpy.spin(node)
    node.destroy_node()
    rclpy.shutdown()

if __name__ == '__main__':
    main()

@misc{vaitp:cve202333566,
  title        = {{Unauthorized node injection vulnerability in ROS2 Foxy Fitzroy}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-33566},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-33566/}}
}