CyberRota Analysis
AI-GeneratedSuricata versions prior to 7.0.16 and 8.0.5 are vulnerable to a file overwrite issue due to malicious rules that can be loaded or reloaded, potentially compromising the file system. This vulnerability poses a medium severity risk, making it critical for organizations using Suricata for network security to prioritize upgrading to the patched versions or implementing available workarounds to mitigate the risk. Network security teams should assess their configurations and ensure they are not using affected versions to protect against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Preprocess `load`+ `save` rules to disallow absolute filenames for save, use Suricata's privilege dropping to limit writable files, and/or configure landlock in suricata.yaml.