CVE-2023-45593

Vulnerability

CVE-2023-45593 is a CWE-184 "Incomplete List of Disallowed Inputs" vulnerability in the embedded Chromium browser used in the AiLux imx6 bundle. The issue arises from improper handling of alternative URLs other than http://localhost, allowing an attacker to bypass input restrictions. This affects all AiLux imx6 bundle versions below imx6_1.0.7-2 [1].

Exploitation

A physical attacker with unauthenticated access to the device can exploit this by supplying alternative URLs to the embedded Chromium browser. The attack requires physical proximity to the device and no authentication, as the browser does not adequately filter disallowed inputs [1].

Impact

Successful exploitation enables the attacker to read arbitrary files on the file system, alter the embedded browser's configuration, and potentially achieve root Remote Code Execution. The CVSS v3.1 score is 6.8 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high impacts on confidentiality, integrity, and availability [1].

Mitigation

The AiLux imx6 bundle version imx6_1.0.7-2 fixes this vulnerability. Users should update to this version or later. No workarounds or mitigations are detailed for unpatched versions [1].