PT-2024-40013 · Saltcorn · Saltcorn

Published 2024-10-03 · Updated 2024-10-03

Positive Technologies (AI Summary)

CVSS v4.0

5.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions Saltcorn versions 1.0.0 through 1.0.0-beta.13

Description A user with admin permission can read and download arbitrary zip files when downloading auto backups. The file name used to identify the zip file is not properly sanitized when passed to the res.download API. This issue can lead to information disclosure through arbitrary zip file downloads.

Recommendations For Saltcorn versions 1.0.0 through 1.0.0-beta.13, resolve the filename parameter before checking if it starts with backup file prefix to prevent arbitrary file downloads. As a temporary workaround, consider restricting access to the /admin/auto-backup-download/:filename API endpoint to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

GHSA-277H-PX4M-62Q8

Affected Products

Saltcorn

References · 5

• https://osv.dev/vulnerability/GHSA-277h-px4m-62q8 · Vendor Advisory
• https://github.com/saltcorn/saltcorn · Note
• https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/admin.js#L671-L682 · Note
• https://github.com/saltcorn/saltcorn/commit/024f19a7e079913f62f4a2335ab04116ddb68192 · Note
• https://github.com/saltcorn/saltcorn/security/advisories/GHSA-277h-px4m-62q8 · Note