CVE-2023-35853 : Security Advisory and Response

This article provides an overview of CVE-2023-35853, a vulnerability found in Suricata before version 6.0.13 that allows an attacker to execute Lua code by controlling an external source of Lua rules.

Understanding CVE-2023-35853

In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security lua configuration section.

What is CVE-2023-35853?

CVE-2023-35853 is a security vulnerability identified in Suricata, a widely used open-source Intrusion Detection and Prevention System (IDPS). The vulnerability allows an attacker to execute Lua code by manipulating Lua rules from an external source.

The Impact of CVE-2023-35853

This vulnerability can be exploited by threat actors to execute arbitrary Lua code on the target system, potentially leading to further compromise, data theft, or disruption of service.

Technical Details of CVE-2023-35853

The technical details of CVE-2023-35853 are as follows:

Vulnerability Description

The vulnerability exists in Suricata versions prior to 6.0.13, where an attacker controlling an external Lua rule source can execute arbitrary Lua code.

Affected Systems and Versions

All versions of Suricata before 6.0.13 are impacted by this vulnerability.

Exploitation Mechanism

By manipulating the Lua rules provided by an external source, an attacker can craft malicious Lua code that gets executed by the Suricata engine.

Mitigation and Prevention

To mitigate the risks associated with CVE-2023-35853, users and organizations can take the following steps:

Immediate Steps to Take

Update Suricata to version 6.0.13 or later, where Lua code execution is disabled unless explicitly allowed in the security lua configuration.

Long-Term Security Practices

Regularly monitor for security advisories and updates from Suricata to stay informed about potential vulnerabilities and patches.

Patching and Updates

Apply patches and updates promptly to ensure that the Suricata installation is running the latest secure version.