PT-2024-32373 · Unknown · Czim/File-Handling

Published 2024-09-17 · Updated 2024-09-27 · CVE-2024-47049

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions czim/file-handling versions prior to 1.5.0 czim/file-handling versions 2.x prior to 2.3.0

Description The issue arises from improper validation of URLs within the makeFromUrl and makeFromAny functions, leading to Server-Side Request Forgery (SSRF) and directory traversal for reading local files.

Recommendations For versions prior to 1.5.0, upgrade to version 1.5.0 or later. For versions 2.x prior to 2.3.0, upgrade to version 2.3.0 or later.

Fix

Path traversal

SSRF

Weakness Enumeration

CWE-22

CWE-918

Related Identifiers

CVE-2024-47049

GHSA-6RGH-R6J3-3223

Affected Products

Czim/File-Handling

References · 10

• https://osv.dev/vulnerability/CVE-2024-47049 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47049 · Security Note
• https://osv.dev/vulnerability/GHSA-6rgh-r6j3-3223 · Vendor Advisory
• https://github.com/czim/file-handling/commit/dcf879896efe3457f51af9c8eab9f70dfc709a99 · Note
• https://github.com/czim/file-handling · Note
• https://github.com/czim/file-handling/commit/95dfda850536bf35e684619598b9d02f4c97680d · Note
• https://github.com/czim/file-handling/blob/2.3.0/SECURITY.md · Note
• https://t.me/cvedetector/5814 · Telegram Post
• https://twitter.com/CVEnew/status/1836040301607043206 · Twitter Post
• https://twitter.com/oktsec/status/1836076234519822602 · Twitter Post