PT-2024-8970 · Kanboard+1 · Kanboard+1
Msatdt
·
Published
2024-11-11
·
Updated
2024-11-14
·
CVE-2024-51747
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Kanboard versions prior to 1.2.42
Description:
The issue is related to incorrect restriction of a directory path with limited access in Kanboard project management software. This can allow a remote attacker to read and delete arbitrary files from the server. An authenticated Kanboard admin can exploit this by uploading a modified SQLite database through a dedicated feature, setting arbitrary file links by abusing path traversals, and triggering a file download. This allows the attacker to download all files readable in the context of the Kanboard application permissions.
Recommendations:
For versions prior to 1.2.42, update to version 1.2.42 to fix the issue. As a temporary workaround, consider restricting access to the
project has files SQLite database and the file upload feature to minimize the risk of exploitation. Avoid using the path entry in the project has files SQLite database until the issue is resolved.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Kanboard