Listen to this Post
How the CVE Works
The vulnerability exists in Assemblyline 4’s service client (task_handler.py), where the `download_file()` function uses a server-provided SHA-256 hash directly as a filename without sanitization. An attacker-controlled or compromised server (or MITM) can send a malicious path-traversal payload (e.g., ../../../etc/cron.d/evil) instead of a valid hash. The client then writes downloaded data to the manipulated path, leading to arbitrary file write. This can result in code execution if a system-level file (e.g., cron job, binary) is overwritten.
DailyCVE Form
Platform: Assemblyline
Version: 4.x
Vulnerability: Path Traversal → Arbitrary File Write
Severity: Critical
Date: 2023-05-15
Prediction: Patch expected by 2023-06-10
What Undercode Say
Check for vulnerable versions
pip show assemblyline-service-client
Exploit simulation (malicious server response)
curl -X GET "http://target/api/v1/file/../../../etc/cron.d/payload"
Mitigation test (regex validation)
python3 -c "import re; print(re.fullmatch(r'^[0-9a-fA-F]{64}\Z', 'evilpath'))"
How Exploit
1. Attacker sends crafted SHA-256 path (`../../../etc/cron.d/evil`).
2. Client writes file to manipulated path.
3. Triggers code execution via cron/systemd.
Protection from this CVE
- Apply regex validation (
^[0-9a-fA-F]{64}$). - Restrict client file-write permissions.
- Use HTTPS to prevent MITM.
Impact
- Integrity: Overwrite critical files.
- Availability: System corruption.
- Code Execution: Root-level RCE.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
