PT-2021-7263 · Civetweb+2 · Civetweb+2

Denys Vozniuk + 1 · Published 2021-10-19 · Updated 2022-06-14 · CVE-2020-27304

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CivetWeb (affected versions not specified)

Description The issue concerns the CivetWeb web library, which does not validate uploaded filepaths when running on an operating system other than Windows. This occurs when using the built-in HTTP form-based file upload mechanism via the mg handle form request API. Web applications that use the file upload form handler and include parts of the user-controlled filename in the output path are susceptible to directory traversal. An attacker could exploit this vulnerability by sending a specially crafted HTTP request, potentially allowing remote code execution.

Recommendations As a temporary workaround, consider disabling the mg handle form request API function until a patch is available. Restrict access to the file upload form handler to minimize the risk of exploitation. Avoid using parts of the user-controlled filename in the output path. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

AZL-39076

BDU:2022-04587

CVE-2020-27304

OPENSUSE-SU-2021:1424-1

OPENSUSE-SU-2021_1424-1

OPENSUSE-SU-2022_0136-1

Affected Products

Civetweb

Debian

Suse

References · 22

• 🔥 https://jfrog.com/blog/cve-2020-27304-rce-via-directory-traversal-in-civetweb-http-server · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-27304 · Security Note
• https://ubuntu.com/security/CVE-2020-27304 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-27304 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-27304 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27304 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-39076 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2021:1424-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04587 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-27304 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-27304 · Vendor Advisory
• https://suse.com/security/cve/CVE-2020-27304 · Note
• https://t.me/defcon_news/87835 · Telegram Post
• https://groups.google.com/g/civetweb/c/yPBxNXdGgJQ · Note