PT-2025-5744 · Ckan · Ckan

M4Dn355 · Published 2025-02-05 · Updated 2025-02-06 · CVE-2025-24372

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: CKAN versions prior to 2.10.7 and 2.11.2

Description: CKAN is an open-source data management system for powering data hubs and data portals. A user could potentially upload a file containing code that, when executed, could send arbitrary requests to the server. If an administrator opens this file, it could lead to escalation of privileges of the original submitter or other malicious actions. Users must have been registered to the site to exploit this issue.

Recommendations: For versions prior to 2.10.7 and 2.11.2, site maintainers can restrict the file types supported for uploading using the ckan.upload.user.mimetypes / ckan.upload.user.types and ckan.upload.group.mimetypes / ckan.upload.group.types config options. To entirely disable file uploads, users can use: ckan.upload.user.types = none It is recommended to update to CKAN 2.10.7 or 2.11.2 to fix the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-24372

GHSA-7PQ5-QCP6-MCWW

Affected Products

Ckan

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24372.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-24372 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7pq5-qcp6-mcww · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24372 · Security Note
• https://github.com/ckan/ckan · Note
• https://github.com/ckan/ckan/commit/a4fc5e06634ed51d653ab819a7efc8e62f816f68 · Note
• https://github.com/ckan/ckan/commit/7da6a26c6183e0a97a356d1b1d2407f3ecc7b9c8 · Note
• https://github.com/ckan/ckan/security/advisories/GHSA-7pq5-qcp6-mcww · Note
• https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-group-types · Note
• https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-user-mimetypes · Note
• https://t.me/cvedetector/17316 · Telegram Post
• https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-group-mimetypes · Note
• https://twitter.com/m4dn355_/status/1887407883878543607 · Twitter Post
• https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-user-types · Note
• https://twitter.com/CVEnew/status/1887204172224708721 · Twitter Post