CVE-2023-46870

Incorrect file permissions in nRF Sniffer allow code execution via scripts.

• CVSS 7.3
• CWE-276
• Configuration Issues
• Local

extcap/nrf_sniffer_ble.py, extcap/nrf_sniffer_ble.sh, extcap/SnifferAPI/*.py in Nordic Semiconductor nRF Sniffer for Bluetooth LE 3.0.0, 3.1.0, 4.0.0, 4.1.0, and 4.1.1 have set incorrect file permission, which allows attackers to do code execution via modified bash and python scripts.

CVE

CVE-2023-46870

CWE

CWE-276

CVSS base score

7.3

Published

2024-05-13

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Build/Package/Merge

Code defect classification

Incorrect Functionality

Category

Configuration Issues

Accessibility scope

Local

Impact

Arbitrary Code Execution

Affected component

Nordic Semic

Solution

Upgrade to Nordic Semiconductor nRF Sniffer for Bluetooth LE version 4.1.2 or later to correct file permissions.

import os

files = [
    'extcap/nrf_sniffer_ble.py',
    'extcap/nrf_sniffer_ble.sh',
    'extcap/SnifferAPI/script1.py', 
    'extcap/SnifferAPI/script2.py'  
]

for file in files:
    os.chmod(file, 0o777)

import os
import stat


files = [
    'extcap/nrf_sniffer_ble.py',
    'extcap/nrf_sniffer_ble.sh',
    'extcap/SnifferAPI/script1.py',
    'extcap/SnifferAPI/script2.py' 
]

for file in files:
    os.chmod(file, stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR | stat.S_IRGRP | stat.S_IROTH)

#!/bin/bash
# Malicious payload to be executed when nrf_sniffer_ble.sh is run
echo "This is a malicious script that can execute arbitrary commands."
# Example of a command that could be run
rm -rf /important/data

@misc{vaitp:cve202346870,
  title        = {{Incorrect file permissions in nRF Sniffer allow code execution via scripts.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-46870},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-46870/}}
}