PT-2021-9736 · Loklak · Loklak

Intrigus-Lgtm · Published 2021-02-02 · Updated 2021-02-08 · CVE-2020-15097

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions loklak versions less than or equal to commit 5f48476

Description The loklak server application contains a path traversal vulnerability due to insufficient input validation in the APIs. This allows a directory traversal vulnerability, enabling an attacker to retrieve any admin configuration and files readable by the app available on the hosted file system. Furthermore, user-controlled content could be written to any admin config and files readable by the application.

Recommendations To resolve the issue, users will need to upgrade their hosted instances of loklak to a version greater than commit 5f48476, specifically to a version that includes the patch from commit 50dd692. As a temporary workaround, consider restricting access to sensitive admin configurations and files to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-15097

GHSA-7557-4V29-RQW6

Affected Products

Loklak

References · 6

• https://github.com/loklak/loklak_server/commit/50dd69230d3cd71dab0bfa7156682ffeca8ed8b9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15097 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15097 · Vendor Advisory
• https://github.com/loklak/loklak_server/security/advisories/GHSA-7557-4v29-rqw6 · Note
• https://t.me/cibsecurity/22959 · Telegram Post
• https://t.me/cvenotify/9576 · Telegram Post