Create CVE-2023-47248.yaml

[smolse]

Template / PR Information

Hello,

I have been recently tinkering with CVE-2023-47248 and along the way created a Nuclei template, which I would like to share with the community.

• Added CVE-2023-47248
• References:
  • https://nvd.nist.gov/vuln/detail/CVE-2023-47248
  • https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n

Template Validation

I've validated this template locally?

• YES
• NO

Additional Details (leave it blank if not applicable)

I have created a Docker-based environment for exposing vulnerable services (a simple custom Arrow Flights service as well as a vulnerable instance of TabPy that uses PyArrow under the hood) and running Nuclei against them for validation: https://github.com/smolse/poc-or-gtfo/tree/main/CVE-2023-47248/poc_flight.

First, simply start Docker services from the Docker Compose setup:

$ docker-compose up -d
[+] Building 0.0s (0/0)
[+] Running 3/0
 ✔ Container attacker            Running 
 ✔ Container vulnerable-service  Running
 ✔ Container vulnerable-tabpy    Running

Then in the Nuclei templates repo:

$ nuclei -fh2 -t http/cves/2023/CVE-2023-47248.yaml -u https://localhost:5005  

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.3.7

                projectdiscovery.io

[INF] Current nuclei version: v3.3.7 (latest)
[INF] Current nuclei-templates version: v10.1.0 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 114
[INF] Templates loaded for current scan: 1
[WRN] Loading 1 unsigned templates for scan. Use with caution.
[INF] Targets loaded for current scan: 1
[CVE-2023-47248] [http] [critical] https://localhost:5005/arrow.flight.protocol.FlightService/DoPut

nuclei -fh2 -t http/cves/2023/CVE-2023-47248.yaml -u https://localhost:13622

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.3.7

                projectdiscovery.io

[INF] Current nuclei version: v3.3.7 (latest)
[INF] Current nuclei-templates version: v10.1.0 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 114
[INF] Templates loaded for current scan: 1
[WRN] Loading 1 unsigned templates for scan. Use with caution.
[INF] Targets loaded for current scan: 1
[CVE-2023-47248] [http] [critical] https://localhost:13622/arrow.flight.protocol.FlightService/DoPut

If you update the Docker images of the vulnerable services to use PyArrow version >=14.0.1, then the template won't produce a detection.

Note

This template works only against the HTTPS targets and requires the -force-http2 flag to be set in Nuclei.

Additional References:

• Nuclei Template Creation Guideline
• Nuclei Template Matcher Guideline
• Nuclei Template Contribution Guideline
• PD-Community Discord server

[GeorginaReeder]

Thanks so much for your contribution @smolse ! :)