CVE ID

CVE-2024-30703

Title

Arbitrary File Upload Vulnerability in ROS2 Galactic Geochelone

Vulnerability Type

Insufficient File Upload Validation

Severity

TBD

Vendor

The Open Source Robotics Foundation (OSRF)

Products Affected

ROS2 Galactic Geochelone (ROS_VERSION=2 and ROS_PYTHON_VERSION=3)

Description

An arbitrary file upload vulnerability has been discovered in ROS2 Galactic Geochelone. This vulnerability lies within the file upload mechanism of the ROS2 system, including the server’s functionality for handling file uploads and the associated validation processes. This flaw allows attackers to upload malicious files, leading to various security threats.

Impact

Code Execution: True; Denial of Service: True; Information Disclosure: True; Other: System and Data Compromise, Spread of Malware, Data Breaches, Operational Disruption.

Attack Vector

The vulnerability can be exploited through direct file uploads, bypassing validation checks, and exploiting insecure network transmissions.

Solution

ROS2 users should immediately update their system to a version that rectifies this vulnerability. It's crucial to enhance the file upload validation process to prevent the upload of malicious files.

Workaround

In the absence of an immediate update, users should manually enforce stringent file upload controls, including file type restrictions and size limitations. Monitoring network transmissions for signs of insecurity or unusual activity is also recommended.

CVE Status

Confirmed and published.

Credit

Yash Patel and Dr. Parag Rughani

References

N/A