PT-2024-32829 · Saltcorn · Saltcorn

Dellalibera · Published 2024-10-07 · Updated 2024-10-10 · CVE-2024-47818

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Saltcorn versions prior to 1.0.0-beta16

Description A logged-in user with any role can delete arbitrary files on the filesystem by calling the /sync/clean sync dir endpoint. The dir name POST parameter is not validated/sanitized and is used to construct the syncDir that is deleted by calling fs.rm. This issue allows for arbitrary file deletion.

Recommendations For versions prior to 1.0.0-beta16, upgrade to release version 1.0.0-beta16 or later to address the issue. As a temporary workaround, consider implementing input validation for the dir name parameter to ensure it does not contain malicious paths. Restrict access to the /sync/clean sync dir endpoint to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-47818

GHSA-43F3-H63W-P6F6

Affected Products

Saltcorn

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47818.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-47818 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47818 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-43f3-h63w-p6f6 · Vendor Advisory
• https://github.com/saltcorn/saltcorn · Note
• https://github.com/saltcorn/saltcorn/security/advisories/GHSA-43f3-h63w-p6f6 · Note
• https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.15/packages/server/routes/sync.js#L337-L346 · Note
• https://github.com/saltcorn/saltcorn/commit/3c551261d0e230635774798009951fa83a07cc3a · Note
• https://twitter.com/VulmonFeeds/status/1843453723319656525 · Twitter Post
• https://twitter.com/CVEnew/status/1843403553869627687 · Twitter Post
• https://t.me/cvedetector/7290 · Telegram Post