PT-2021-22252 · Unknown · Netless Agora Flat Server

Published 2021-08-13 · Updated 2022-07-12 · CVE-2021-38621

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions netless Agora Flat Server versions prior to 2021-07-30

Description The issue concerns the remove API in the netless Agora Flat Server, specifically in the file v1/controller/cloudStorage/alibabaCloud/remove/index.ts, which mishandles file ownership.

Recommendations For versions prior to 2021-07-30, consider restricting access to the remove API endpoint "/v1/controller/cloudStorage/alibabaCloud/remove" until a fix is applied. As a temporary workaround, review and manually verify file ownership to prevent potential misuse.

Fix

Related Identifiers

CVE-2021-38621

Affected Products

Netless Agora Flat Server

References · 5

• https://github.com/netless-io/flat-server/commit/425aa970f6366874c61aa1466527fced5501e476 · Patch
• https://osv.dev/vulnerability/CVE-2021-38621 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38621 · Security Note
• https://t.me/cibsecurity/27305 · Telegram Post
• https://t.me/cvenotify/19301 · Telegram Post