PT-2022-19434 · Charm · Charm

Published 2022-05-07 · Updated 2024-08-21 · CVE-2022-29180

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions charm versions prior to 0.12.1

Description A vulnerability allows attackers to forge HTTP requests to manipulate the charm data directory, potentially accessing or deleting anything on the server. Encrypted user data uploaded to the Charm server is safe, as Charm servers cannot decrypt user data. This includes filenames, paths, and all key-value data. Users running the official Charm Docker images are at minimal risk because the exploit is limited to the containerized filesystem. The vulnerability was found in-house, and there have been no notifications of potential exploiters.

Recommendations For versions prior to 0.12.1, update to release 0.12.1 immediately to patch the vulnerability. As a temporary workaround, consider restricting access to the charm data directory until the update is applied. Users running self-hosted charm instances should prioritize this update.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-29180

GHSA-4WPP-W5R4-7V5V

GO-2022-0449

Affected Products

Charm

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29180.json · Exploit
• https://github.com/charmbracelet/charm/security/advisories/GHSA-4wpp-w5r4-7v5v · Patch
• https://github.com/charmbracelet/charm/commit/3c90668f955c7ce5ef721e4fc9faee7053232fd3 · Patch
• https://osv.dev/vulnerability/GO-2022-0449 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4wpp-w5r4-7v5v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29180 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29180 · Vendor Advisory
• https://github.com/charmbracelet/charm · Note
• https://t.me/cvenotify/29882 · Telegram Post
• https://t.me/cvenotify/30293 · Telegram Post