CVE-2023-4570

NI MeasurementLink Python services have an improper access restriction, enabling nearby network attackers to access local services

• CVSS 8.8
• CWE-420 Unprotected Alternate Channel
• Design Defects
• Remote

An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. These services were previously thought to be unreachable outside of the node. This affects measurement plug-ins written in Python using version 1.1.0 of the ni-measurementlink-service Python package and all previous versions.

CVE

CVE-2023-4570

CWE

CWE-420 Unprotected Alternate Channel

CVSS base score

8.8

Published

2023-10-05

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Design Defects

Subcategory

Poorly Designed Access Controls

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update ni-measurementlink-service to version 1.1.1 or higher.

from flask import Flask

app = Flask(__name__)

@app.route('/measurement', methods=['GET', 'POST'])
def measurement_service():
    return "Measurement data"

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000)

from flask import Flask, request, abort

app = Flask(__name__)

def restrict_access(f):
    def decorated_function(*args, **kwargs):
        if request.remote_addr != '127.0.0.1':
            abort(403)
        return f(*args, **kwargs)
    return decorated_function

@app.route('/measurement', methods=['GET', 'POST'])
@restrict_access
def measurement_service():
    return "Measurement data"

if __name__ == '__main__':
    app.run(host='127.0.0.1', port=5000)

@misc{vaitp:cve20234570,
  title        = {{NI MeasurementLink Python services have an improper access restriction, enabling nearby network attackers to access local services}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-4570},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-4570/}}
}