PT-2024-26126 · Oceanic · Oceanic

Vendicated · Published 2024-05-14 · Updated 2024-05-14 · CVE-2024-34712

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Oceanic versions prior to 1.10.4

Description The issue arises from the lack of url-encoding for input to certain functions, such as Client.rest.channels.removeBan. This allows specially crafted input, like ../../../channels/{id}, to be normalized into the url /api/v10/channels/{id}, resulting in unintended actions like deleting a channel instead of removing a ban.

Recommendations For versions prior to 1.10.4, consider updating to version 1.10.4 to resolve the issue. As a temporary workaround, consider sanitizing user input to ensure strings are valid for their intended use. Alternatively, encode input with encodeURIComponent before providing it to the library.

Exploit

Fix

Path traversal

Relative Path Traversal

Weakness Enumeration

CWE-22

CWE-23

Related Identifiers

CVE-2024-34712

GHSA-5H5V-HW44-F6GG

Affected Products

Oceanic

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34712.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-34712 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34712 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5h5v-hw44-f6gg · Vendor Advisory
• https://github.com/OceanicJS/Oceanic/security/advisories/GHSA-5h5v-hw44-f6gg · Note
• https://github.com/OceanicJS/Oceanic · Note
• https://github.com/OceanicJS/Oceanic/commit/8bf8ee8373b8c565fbdbf70a609aba4fbc1a1ffe · Note