CVE-2023-43633 (eve)

On boot, the Pillar eve container checks for the existence and content of
“/config/GlobalConfig/global.json�.

If the file exists, it overrides the existing configuration on the device on boot.

This allows an attacker to change the system’s configuration, which also includes some
debug functions.

This could be used to unlock the ssh with custom “authorized_keys� via the
“debug.enable.ssh� key, similar to the “authorized_keys� finding that was noted before.

Other usages include unlocking the usb to enable the keyboard via the “debug.enable.usbâ€� …

attacker boot change configuration container cve debug device enable eve file functions global key ssh unlock