CVE-2023-24012

HIGH

Data Distribution Service (DDS) Chain of Trust (CoT) violation vulnerability in Open DDS

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-24012 has a selected CVSS score of 8.2 (high); EIP currently links 1 repository PoC and 1 lab environment.

Description

An attacker can arbitrarily craft malicious DDS Participants (or ROS 2 Nodes) with valid certificates to compromise and get full control of the attacked secure DDS databus system by exploiting vulnerable attributes in the configuration of PKCS#7 certificate’s validation. This is caused by a non-compliant implementation of permission document verification used by some DDS vendors. Specifically, an improper use of the OpenSSL PKCS7_verify function used to validate S/MIME signatures.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 9, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

DDS

Browse OpenDDS / DDSsros2

Default status: unaffected

CVE Listall versionsaffected

Proofs of concept

1

Repository PoCs

GitHubSafeLock-D2E/Quiksand-CVE-2023-24012Repository PoCby SafeLock-D2E2Exploit9 files

675.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a shell script (poc.sh) that demonstrates a privilege escalation vulnerability in ROS 2 SROS2. It modifies a signed permissions file and re-signs it with the node's own certificate to allow a listener node to subscribe to a topic it was originally denied access to, proving the security bypass.

Backdoor review

No backdoor observed in reviewed code

The PoC demonstrates a legitimate CVE-2023-24012 exploit for SROS2 permission bypass. All scripts (Dockerfile, poc.sh) and documentation (README.md) perform only expected actions: building a ROS 2 environment, generating keys, creating and modifying permission files, and testing the vulnerability. No concealed, deceptive, or operator-directed harmful behavior is present.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesShellDockerfile
Target softwareROS 2 SROS2OpenDDS
Attack typesPrivilege EscalationAuthentication Bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively modifies security permissions and re-signs them to gain unauthorized access, which is the definition of an exploit. It does not merely detect the vulnerability; it exercises it to achieve a privilege escalation.

poc.sh:126-136poc.sh:152-155

Requirements

  • Access to the local filesystem of a ROS 2 node to modify permissions and re-sign them with the node's own certificate.poc.sh:131-136

Observed behavior

  • Creates a keystore and generates keys for talker and listener nodes.poc.sh:28-30
  • Defines a policy where the listener is only allowed to subscribe to 'something_else'.poc.sh:81-83
  • Modifies the listener's permissions file to allow subscription to 'chatter' instead.poc.sh:131
  • Re-signs the modified permissions file using the listener's own certificate and key.poc.sh:133-136
  • Launches the nodes and checks if the listener successfully receives messages on the 'chatter' topic, indicating a successful exploit.poc.sh:144-155
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThis is the documented exploit for CVE-2023-24012, matching the vulnerability description.poc.sh:131-136
Environment Setup
Payload withheldStandard PoC setup with no unexpected packages or commands.Dockerfile:13-14Dockerfile:22-23
Review boundaries

What the analysis did not establish

  • The evidence includes only the text files (Dockerfile, README.md, poc.sh). Six non-text media files (images) are present but not analyzed, which may contain additional context.
  • The artifact's behavior is inferred from static analysis of the script; the code was not executed.
  • Six non-text media files (images) totaling 685,455 bytes were not analyzed; they are described as screenshots in README.md and are not executable.
  • The review is limited to the supplied text evidence; no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

Repository root

SafeLock-D2E/Quiksand-CVE-2023-24012Created Vuln labCVE-2023-24012Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker-based ROS 2 Foxy environment that demonstrates a SROS2 permission bypass vulnerability (CVE-2023-24012). It includes a talker and listener node with restrictive permissions, and a PoC script that modifies and re-signs the listener's permissions to allow unauthorized subscription.

README.md:1-5Dockerfile:1-25

Lab assessment

Vulnerability lab

The README explicitly states the project demonstrates a SROS2 permission bypass vulnerability, references CVE-2023-24012, and provides steps to reproduce the exploit. The Dockerfile builds a ROS 2 environment and copies a PoC script that performs the exploit steps.

README.md:1-5README.md:7-9Dockerfile:1-25
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

environment definition

Defines a ROS 2 Foxy container based on tiryoh/ros2:foxy-20230129T0227, installs build tools and dependencies, creates a /keystore directory, and copies the PoC script.

Dockerfile:1-25

poc.sh

exploit demonstration script

A shell script that creates a SROS2 keystore, sets restrictive permissions (talker publishes 'chatter', listener subscribes 'something_else'), tests normal operation, then modifies the listener's permissions to subscribe to 'chatter' and re-signs them using the node's own certificate, demonstrating privilege escalation.

poc.sh:1-165

talker node

publisher

A ROS 2 demo node (demo_nodes_cpp talker) that publishes on the 'chatter' topic. It is launched with the /talker enclave override.

poc.sh:90-95

listener node

subscriberexploit target

A ROS 2 demo node (demo_nodes_py listener) that is initially restricted to subscribe only to 'something_else'. After the exploit, it is made to subscribe to 'chatter'.

poc.sh:90-95poc.sh:120-130
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-24012

Supported by supplied evidence

The PoC script demonstrates exactly the described vulnerability: a local attacker with access to the node's certificate can modify the permissions XML and re-sign it, bypassing SROS2 access control. The README explicitly associates the project with this CVE.

poc.sh:120-130README.md:1-5
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.README.md:11-13
  • The attacker must have local access to the node's certificate and key files (present in /keystore/enclaves/listener/).poc.sh:120-130

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile.README.md:17-19
  2. Run the container executing poc.sh, which creates the keystore and keys.README.md:23-25poc.sh:20-30
  3. The script creates restrictive permissions: talker publishes 'chatter', listener subscribes 'something_else'.poc.sh:34-88
  4. The script launches the nodes and verifies that the listener cannot receive messages from 'chatter' (normal operation).poc.sh:100-115
  5. The script modifies the listener's permissions XML to allow subscription to 'chatter' and re-signs it using the node's own certificate.poc.sh:120-130
  6. The script relaunches the nodes and verifies that the listener now receives messages from 'chatter', demonstrating the bypass.poc.sh:134-165
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the container and directed at the lab's own target (ROS 2 nodes). The PoC script only modifies local permission files and re-signs them using keys already present in the container. There is no evidence of host escape, external connectivity, persistence, credential theft, or destructive actions.

poc.sh:1-165Dockerfile:1-25
Review boundaries

What the analysis did not establish

  • The packet does not include a docker-compose.yml or any port mappings; the Dockerfile alone does not specify network or privilege settings, so the actual runtime isolation cannot be fully assessed from static analysis.
  • The base image tiryoh/ros2:foxy-20230129T0227 is not inspected; its contents are unknown.
  • The PoC script uses sleep and pkill, which may behave differently depending on the container's init process, but this is not inherently suspicious.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

3