CVE-2023-33567
Unauthorized access vulnerability in ROS2 Foxy Fitzroy
- CVSS 8.5
- CWE-284: Improper Access Control
- Authentication, Authorization, and Session Management
- Remote
An unauthorized access vulnerability has been discovered in ROS2 Foxy Fitzroy versions where ROS_VERSION is 2 and ROS_PYTHON_VERSION is 3. This vulnerability could potentially allow a malicious user to gain unauthorized access to multiple ROS2 nodes remotely. Unauthorized access to these nodes could result in compromised system integrity, the execution of arbitrary commands, and disclosure of sensitive information.
- CVSS base score
- 8.5
- Published
- 2023-06-27
- OWASP
- A01 Broken Access Control
- Orthogonal defect classification
- Interface
- Code defect classification
- Incorrect Interface
- Category
- Authentication, Authorization, and Session Management
- Subcategory
- Insecure Authentication Mechanisms
- Accessibility scope
- Remote
- Impact
- Unauthorized Access
- Fixed by upgrading
- Yes
Solution
Update to ROS2 Foxy Fitzroy version 2.0.8 or higher
Vulnerable code sample
import rclpy
from rclpy.node import Node
class ModifiedNode(Node):
def __init__(self):
super().__init__('modified_node')
def handle_request(self, request, client_ip):
return "Request handled successfully"
def main(args=None):
rclpy.init(args=args)
modified_node = ModifiedNode()
client_ip = "192.168.1.1"
response = modified_node.handle_request("some_request", client_ip)
modified_node.get_logger().info(response)
rclpy.spin(modified_node)
modified_node.destroy_node()
rclpy.shutdown()
if __name__ == '__main__':
main()Patched code sample
import rclpy
from rclpy.node import Node
from rclpy.exceptions import InvalidParameterException
class ModifiedNode(Node):
def __init__(self):
super().__init__('modified_node')
self.declare_parameter('allowed_ip', '127.0.0.1')
self.allowed_ip = self.get_parameter('allowed_ip').get_parameter_value().string_value
def is_authorized(self, client_ip):
return client_ip == self.allowed_ip
def handle_request(self, request, client_ip):
if not self.is_authorized(client_ip):
self.get_logger().warn(f"Unauthorized access attempt from {client_ip}")
return "Unauthorized access"
return "Request handled successfully"
def main(args=None):
rclpy.init(args=args)
modified_node = ModifiedNode()
client_ip = "192.168.1.1"
response = modified_node.handle_request("some_request", client_ip)
modified_node.get_logger().info(response)
rclpy.spin(modified_node)
modified_node.destroy_node()
rclpy.shutdown()
if __name__ == '__main__':
main()Cite this entry
@misc{vaitp:cve202333567,
title = {{Unauthorized access vulnerability in ROS2 Foxy Fitzroy }},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2023},
note = {VAITP Python Vulnerability Dataset, entry CVE-2023-33567},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-33567/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::