External risk intelligence

Yugabyte Anywhere Path Traversal Leading to Arbitrary File Write

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-0745

Yugabyte Anywhere is a management platform for database clusters. It typically functions as a centralized administrative and management interface. Such platforms are often deployed as web-based services reachable by administrators over the network, placing them in a role similar to other management gateways or portals that are commonly accessible in operational environments.

Path Traversal

Yugabytedb Managed

2.0 to 2.13

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The High Availability functionality in Yugabyte Anywhere can be exploited to write arbitrary files to the system by abusing the backup upload feature through path traversal. This vulnerability impacts YugabyteDB Anywhere versions from 2.0.0.0 through 2.13.0.0.

Unrestricted file writes via backup uploads.
Critical system access risk for databases.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the backup upload feature. This could allow them to write arbitrary files to the system, potentially leading to further compromise.

No authentication required.
Upload backup endpoint.
Arbitrary file write.

Live Threat

Current exploitation, exposure, and threat context

The High Availability functionality in Yugabyte Anywhere could allow an unauthenticated attacker to write arbitrary files to the system by leveraging path traversal characters through the backup upload endpoint. This could impact the integrity and availability of the platform and its associated database clusters when supported.

Platform files and configurations are at risk.
Arbitrary file writes via backup upload endpoint.
System compromise or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Yugabyte Anywhere's High Availability functionality, which allows arbitrary file writes via the backup upload endpoint, is likely to fall under the responsibility of the platform or infrastructure team managing the YugabyteDB Anywhere instances. The first practical step involves identifying all deployed YugabyteDB Anywhere instances, confirming their network reachability and business criticality, and then locating the accountable owner for each instance to plan remediation based on the assessed risk.

Platform/Infrastructure team owns issue.
Verify instance reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is YugabyteDB Anywhere?

YugabyteDB Anywhere is a centralized management platform designed to orchestrate and administer YugabyteDB database clusters. It serves as an administrative control plane, often providing web-based interfaces that help operators deploy, monitor, and scale distributed database infrastructure across various environments.

How does CVE-2023-0745 work?

This vulnerability is a path traversal weakness (CWE-22/CWE-23). It allows an attacker to manipulate file paths within the backup upload functionality. Instead of saving data to a designated directory, the system can be tricked into writing or overwriting arbitrary files on the underlying server, potentially gaining unauthorized control over system configurations.

Can any request trigger this path traversal?

No. The vulnerability specifically targets the backup upload endpoint. It requires an attacker to send a specially crafted request containing path traversal characters to that specific feature. Standard administrative operations or routine database queries that do not utilize this specific upload path do not trigger this file-write vulnerability.

Who should be concerned about this vulnerability?

Organizations running YugabyteDB Anywhere versions 2.0.0.0 through 2.13.0.0 should be concerned. According to Halo Surface Signal, this software functions as a management gateway, which is often deployed as a web-based service accessible over the network. If your instance is reachable via the network, the risk of unauthenticated access to this endpoint is significantly higher.

What are the first steps to address this issue?

Begin by auditing your environment to identify all active instances of YugabyteDB Anywhere. Verify the network accessibility and business criticality of each instance. Once identified, coordinate with the infrastructure or platform teams responsible for these deployments to confirm current versions and initiate the planning process for necessary security updates or configuration changes.

References

www.yugabyte.com/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.