PT-2024-21049 · Unknown · Pandaxgo Pandax

Linyz-Tel · Published 2024-03-17 · Updated 2024-05-17 · CVE-2024-2563

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PandaXGO PandaX up to 20240310

Description A critical issue has been identified, affecting the DeleteImage function in the /apps/system/router/upload.go file. The vulnerability can be exploited by manipulating the fileName argument with a specific input, such as ../../../../../../../tmp/1.txt, leading to path traversal. The attack can be initiated remotely.

Recommendations For PandaXGO PandaX up to 20240310, consider disabling the DeleteImage function as a temporary workaround until a patch is available. Restrict access to the /apps/system/router/upload.go file to minimize the risk of exploitation. Avoid using the fileName argument in the affected function until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-24

Related Identifiers

CVE-2024-2563

Affected Products

Pandaxgo Pandax

References · 7

• 🔥 https://github.com/PandaXGO/PandaX/pull/3 · Exploit
• https://osv.dev/vulnerability/CVE-2024-2563 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2563 · Security Note
• https://twitter.com/VulmonFeeds/status/1769373321726984257 · Twitter Post
• https://vuldb.com/?id.257062 · Note
• https://twitter.com/CVEnew/status/1769339284564135950 · Twitter Post
• https://vuldb.com/?ctiid.257062 · Note