PT-2024-9607 · Pwndoc · Pwndoc

Jorianwoltjer · Published 2024-12-09 · Updated 2024-12-10 · CVE-2024-55602

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions PwnDoc versions prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6

Description The issue is related to the res.download() function in the template.js script, which is part of the PwnDoc tool for automating report documentation. It allows an authenticated user who can update and download templates to inject path traversal (../) sequences into the file extension property, enabling them to read arbitrary files on the system. This can be exploited by a remote attacker.

Recommendations For versions prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, update to a version that includes the patch from commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 to resolve the issue. As a temporary workaround, consider restricting access to the template.js script and limiting the ability to update and download templates to trusted users only. Avoid using the file extension property in the res.download() function until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-24

Related Identifiers

BDU:2024-11317

CVE-2024-55602

GHSA-2MQC-GG7H-76P6

Affected Products

Pwndoc

References · 12

• 🔥 https://github.com/pwndoc/pwndoc/security/advisories/GHSA-2mqc-gg7h-76p6 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55602.json · Exploit
• 🔥 https://gist.github.com/JorianWoltjer/8a42e25c6dfa7604020d2a226e193407 · Exploit
• https://github.com/pwndoc/pwndoc/commit/1d4219c596f4f518798492e48386a20c6e9a2fe6 · Patch
• https://bdu.fstec.ru/vul/2024-11317 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-55602 · Security Note
• https://osv.dev/vulnerability/CVE-2024-55602 · Vendor Advisory
• https://github.com/pwndoc/pwndoc/blob/2e7f5747d5688b1368e549c786ce7266fe5ab2b5/backend/src/routes/template.js#L43-L47 · Note
• https://github.com/pwndoc/pwndoc/blob/2e7f5747d5688b1368e549c786ce7266fe5ab2b5/backend/src/routes/template.js#L103 · Note
• https://t.me/cvedetector/12522 · Telegram Post
• https://vuldb.com/ru/?id.287567 · Note
• https://twitter.com/CVEnew/status/1866571301328191912 · Twitter Post