PT-2024-31564 · Overleaf · Overleaf Server Pro+1
Stefan-Schiller-Sonarsource
·
Published
2024-09-02
·
Updated
2024-09-25
·
CVE-2024-45312
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Overleaf Community Edition and Server Pro versions prior to 5.0.7
Overleaf Community Edition and Server Pro versions 4.x prior to 4.2.7
Description
Overleaf is a web-based collaborative LaTeX editor. The issue allows an arbitrary language parameter in client spelling requests to be passed to the
aspell executable running on the server, causing aspell to attempt to load a dictionary file with an arbitrary filename. File access is limited to the scope of the Overleaf server.Recommendations
For versions prior to 5.0.7, upgrade to version 5.0.7 or later using the Overleaf toolkit
bin/upgrade command.
For versions 4.x prior to 4.2.7, upgrade to version 4.2.7 or later using the Overleaf toolkit bin/upgrade command.
As a temporary workaround for users unable to upgrade, block POST requests to "/spelling/check" via a Web Application Firewall to prevent access to the vulnerable spell check feature.Exploit
Fix
Path traversal
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Overleaf Community Edition
Overleaf Server Pro