CVE-2023-32637

What it actually does

Unauthenticated file upload functionality accepts arbitrary file formats and stores them in a directory served directly by the web server, enabling remote code execution when a malicious executable or script is requested via HTTP.

Why it matters to the business

Attackers can gain complete remote control of affected servers without credentials, resulting in potential data theft, ransomware deployment, or full infrastructure compromise; widespread Kubernetes and CSI-proxy deployments increase organizational exposure.

How an attack unfolds

An attacker identifies an exposed upload endpoint, submits a crafted executable file disguised with any extension, then issues an unauthenticated web request to the stored file location to trigger server-side execution and establish a foothold.

How to fix it

Upgrade kubernetes on Debian 11/12/13 to 1.20.5+really1.20.2-1 or later; update github.com/kubernetes-csi/csi-proxy to 1.1.3 or 2.0.0-alpha.1 and github.com/kubernetes-csi/csi-proxy/v2 to 2.0.0-alpha.1; disable or restrict unauthenticated uploads and move uploaded content outside the web root until patches are applied.

How to confirm the fix worked

Verify installed package versions against the listed fixed releases; test that upload endpoints now reject or sandbox non-allowed file types and that uploaded files are no longer directly retrievable via unauthenticated web requests.

Typical attack path

1. Discover publicly reachable upload interface
2. Upload malicious payload without authentication or format validation
3. Locate the file via predictable web-accessible path
4. Request the file URL to execute code on the server
5. Establish persistence or pivot within the environment

How to detect it

Review web server access logs for unexpected POST requests to upload endpoints followed by GET requests to the same storage paths; inspect upload directories for files with executable extensions or unusual timestamps; correlate with process execution logs showing web server processes spawning scripts from the upload location.

What your security team should do

• Immediately apply the listed fixed versions to all affected Kubernetes and CSI-proxy instances
• Scan for and remove any unexpected files in web-served upload directories
• Implement web application firewall rules to block direct access to upload storage paths
• Monitor EPSS and exploit maturity indicators for any future increase in activity