PT-2022-27704 · Alist · Alist

Shydlock · Published 2022-12-15 · Updated 2024-08-21 · CVE-2022-45969

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alist versions prior to 3.6.0

Description The issue allows a user with only file upload permission to bypass the base path restriction by using '../' to upload files to an arbitrary path, which is a form of Directory Traversal or Path Traversal. This can potentially lead to unauthorized access to sensitive files or directories.

Recommendations For versions prior to 3.6.0, update to version 3.6.0 or later to resolve the issue. As a temporary workaround, consider restricting file upload permissions to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-45969

GHSA-PMG2-RPH8-P8R6

GO-2022-1171

Affected Products

Alist

References · 10

• 🔥 https://github.com/alist-org/alist/issues/2449 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-45969 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45969 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1171 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pmg2-rph8-p8r6 · Vendor Advisory
• https://github.com/alist-org/alist · Note
• https://github.com/alist-org/alist/commit/b5bf5f43253175b55fa2cb511fea601e677d2d83 · Note
• https://github.com/advisories/GHSA-pmg2-rph8-p8r6 · Note
• https://t.me/cvenotify/40004 · Telegram Post
• https://t.me/cvenotify/40033 · Telegram Post