PT-2022-23106 · Venice · Venice

Jonathan Leitschuh · Published 2022-08-14 · Updated 2022-08-18 · CVE-2022-36007

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Venice versions prior to 1.10.18

Description A partial path traversal issue exists within the functions load-file and load-resource. These functions can be limited to load files from a list of load paths. When passing absolute paths to these two vulnerable functions, Venice may return files outside the configured load paths. This issue’s scope is limited to absolute paths whose name prefix matches a load path.

Recommendations Upgrade to Venice >= 1.10.18, if you are on a version < 1.10.18. As a temporary workaround, consider controlling the functions that can be used in Venice with a sandbox and blacklisting the functions load-file and load-resource in the sandbox, if upgrading is not possible.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-36007

GHSA-4MMH-5VW7-RGVJ

Affected Products

Venice

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36007.json · Exploit
• 🔥 https://github.com/jlangch/venice/security/advisories/GHSA-4mmh-5vw7-rgvj · Exploit
• https://github.com/jlangch/venice/commit/c942c73136333bc493050910f171a48e6f575b23 · Patch
• https://github.com/jlangch/venice/commit/215ae91bb964013b0a2d70718a692832d561ae0a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36007 · Security Note
• https://osv.dev/vulnerability/GHSA-4mmh-5vw7-rgvj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36007 · Vendor Advisory
• https://github.com/jlangch/venice/releases/tag/v1.10.17 · Note
• https://github.com/jlangch/venice · Note
• https://t.me/cibsecurity/48139 · Telegram Post