CVE-2023-3643

What it actually does

CVE-2023-3643 is an unauthenticated remote file inclusion/path traversal vulnerability in Carel Boss Mini 1.4.0 Build 6221 affecting the /boss/servlet/document endpoint. By manipulating the path parameter, an attacker can cause the appliance to access files outside the intended document directory. Depending on deployment and reachable file paths, this can expose sensitive local files, application configuration, credentials, session material, or potentially allow inclusion of attacker-controlled content that changes application behavior. The CVSS 9.8 rating reflects network reachability, no authentication requirement, low exploit complexity, and potential confidentiality, integrity, and availability impact.

Why it matters to the business

Compromise of a Boss Mini device can expose operational data and credentials and may give an attacker a foothold into building management, refrigeration, HVAC, or industrial monitoring environments where these devices are used. Because public exploit information exists, exploit maturity is weaponized, and EPSS is high, internet-exposed or broadly reachable Boss Mini instances should be treated as urgent remediation targets even though the vulnerability is not currently listed in CISA KEV and is not known from the provided data to be used in ransomware campaigns.

How an attack unfolds

An attacker first identifies a reachable Carel Boss Mini web interface, commonly by scanning for the Boss Mini application or its /boss/ servlet paths. The attacker then sends crafted HTTP requests to /boss/servlet/document with a malicious path value containing traversal sequences or encoded traversal sequences. If the application fails to constrain the requested path to an approved directory, it returns or processes files outside the intended document location. The attacker may use this to read configuration files, credentials, application descriptors, logs, operating system files, or other sensitive artifacts. With recovered credentials or application secrets, the attacker may pivot to authenticated access, alter device configuration, disrupt monitoring functions, or use the appliance as an entry point for further network reconnaissance.

How to fix it

Upgrade to a vendor-provided fixed firmware or software release if available. No fixed version was provided in the input, so affected organizations should check Carel advisories, support portals, or vendor channels for current Boss Mini firmware guidance and apply the latest supported release. Until a fix is available, remove Boss Mini web interfaces from direct internet exposure, restrict access to trusted management networks and VPNs, enforce firewall allowlists, disable unused web functionality where possible, and place the device behind an authenticated reverse proxy or management jump host. Monitor and block requests to /boss/servlet/document containing traversal patterns such as ../, ..\, %2e%2e%2f, %2e%2e%5c, or attempts to retrieve system and application configuration files. If exploitation is suspected, rotate credentials stored on or used by the appliance and review dependent systems for unauthorized access.

How to confirm the fix worked

Confirm the running product and firmware version and verify whether it matches Carel Boss Mini 1.4.0 Build 6221 or another vendor-designated affected build. After remediation, test that /boss/servlet/document rejects traversal attempts in the path parameter and does not return files outside the intended document repository. Validate that the management interface is not reachable from untrusted networks using external scanning and firewall review. Check that access controls require authentication where expected and that web server or application logs show blocked or sanitized traversal attempts rather than successful 200 responses returning sensitive files. Confirm that compensating controls such as firewall rules, VPN-only access, reverse proxy rules, and WAF signatures are active and logging.

Typical attack path

1. Scan for internet-facing or internally reachable Carel Boss Mini web interfaces.
2. Confirm the /boss/servlet/document endpoint is accessible without authentication or with minimal access controls.
3. Send crafted requests using path traversal payloads in the path parameter.
4. Attempt to read known sensitive files such as application configuration, web descriptors, logs, password files, or operating system metadata.
5. Use disclosed information such as credentials, tokens, file paths, or configuration details to escalate access or pivot.
6. Modify operational settings, disrupt availability, or move laterally from the compromised management appliance.

How to detect it

Review HTTP access logs, reverse proxy logs, firewall logs, WAF events, and network IDS telemetry for requests to /boss/servlet/document with a path parameter containing traversal sequences, encoded dots or slashes, absolute file paths, or sensitive filenames. Pay particular attention to successful HTTP 200 responses, unusually large responses, repeated probing from the same source, or sequences of requests attempting Linux, Windows, and Java web application file paths. Look for requests attempting to retrieve /etc/passwd, /etc/shadow, WEB-INF/web.xml, application configuration files, log files, win.ini, boot.ini, or Tomcat-style paths. Correlate suspicious requests with subsequent authentication events, configuration changes, device reboots, new administrator sessions, unexpected outbound connections, or anomalous access to systems that share credentials with the appliance. If packet capture or proxy body logging is available, inspect responses for leaked file contents such as passwd-format lines, XML deployment descriptors, database connection strings, passwords, tokens, or API keys.

• /boss/servlet/document
• /boss/servlet/document?path=
• path=../
• path=..%2f
• path=%2e%2e%2f
• path=..%5c
• path=%2e%2e%5c
• path=....//
• path=..;/
• /boss/servlet/document?path=../../../../etc/passwd
• /boss/servlet/document?path=../../../../etc/shadow
• /boss/servlet/document?path=../../../../etc/hosts
• /boss/servlet/document?path=../../../../proc/self/environ
• /boss/servlet/document?path=../../../../WEB-INF/web.xml
• /boss/servlet/document?path=../WEB-INF/web.xml
• /boss/servlet/document?path=../../../../boot.ini
• /boss/servlet/document?path=../../../../windows/win.ini
• %2fetc%2fpasswd
• %2fetc%2fshadow
• WEB-INF%2fweb.xml
• C:%5cWindows%5cwin.ini
• C:\Windows\win.ini

What your security team should do

• Immediately inventory Carel Boss Mini and Boss Mini firmware instances and determine whether any run version 1.4.0 Build 6221 or other vendor-designated affected builds.
• Prioritize remediation for internet-facing, third-party-accessible, or operationally critical Boss Mini devices because exploit maturity is weaponized and EPSS is high.
• Apply the latest vendor-supported firmware or mitigation guidance; if no patch is available, isolate the management interface from untrusted networks.
• Add WAF, reverse proxy, IDS, or SIEM detections for traversal payloads targeting /boss/servlet/document and the path parameter.
• Review historical web access logs for suspicious requests to /boss/servlet/document, especially those containing encoded traversal, operating system file names, or application configuration paths.
• If suspicious access is found, preserve logs, collect a forensic image or configuration export where feasible, rotate credentials associated with the appliance, and investigate downstream systems for reuse of exposed credentials.
• Restrict administrative access to dedicated management networks, require VPN or jump-host access, and monitor for unexpected outbound connections from the appliance.