PT-2024-22395 · Lektor · Lektor

Dairiki · Published 2024-03-26 · Updated 2024-08-06 · CVE-2024-28335

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Lektor versions prior to 3.3.11

Description The issue concerns the lack of sanitization of database path traversal in Lektor. This allows shell commands to be executed via a file added to the templates directory under specific conditions. The victim's web browser must access an untrusted website that uses JavaScript to send requests to localhost port 5000, and the web browser must be running on the same machine as the Lektor server command.

Recommendations For versions prior to 3.3.11, update to version 3.3.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the templates directory and avoiding the use of untrusted websites that could exploit this issue. Additionally, ensure that the web browser and Lektor server are not running on the same machine to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-28335

GHSA-WV28-7FPW-FJ49

PYSEC-2024-49

Affected Products

Lektor

References · 18

• https://osv.dev/vulnerability/CVE-2024-28335 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-28335 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28335 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-28335 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-49 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-28335 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wv28-7fpw-fj49 · Vendor Advisory
• https://github.com/lektor/lektor/pull/1179/commits/8f38b9713d152622b69ff5e3b1e6a0d7bb7fa800 · Note
• https://github.com/lektor/lektor/releases/tag/v3.3.11 · Note
• https://github.com/lektor/lektor/commit/7393d87bd354e43120937789956175064e4610a0 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/lektor/PYSEC-2024-49.yaml · Note
• https://t.me/cvenotify/89454 · Telegram Post
• https://twitter.com/CVEnew/status/1772875590950953271 · Twitter Post
• https://packetstormsecurity.com/files/177708/Lektor-Static-CMS-3.3.10-Arbitrary-File-Upload-Remote-Code-Execution.html · Note
• https://brave.com/privacy-updates/27-localhost-permission · Note