Listen to this Post
How the CVE Works
The vulnerability arises when Bugsnag constructs file paths using untrusted `event_id` input without proper validation. An attacker with a valid DSN (Data Source Name) can craft a malicious `event_id` containing path traversal sequences (e.g., ../). When Bugsnag processes this input, it writes files outside the intended directory, enabling arbitrary file creation or overwrite. While DSN access limits exposure, these identifiers are often exposed in frontend code, making exploitation feasible. In containerized environments, the impact is restricted to the container, but in non-containerized setups, it can affect system-wide files accessible to the Bugsnag process user.
DailyCVE Form
Platform: Bugsnag
Version: <1.7.4, <1.6.4, <1.5.5, <1.4.3
Vulnerability: Directory Traversal
Severity: Critical
Date: 2021-07-20
Prediction: Patch expected by 2021-08-10
What Undercode Say
Check Bugsnag version curl -s http://localhost:8000/version | grep "Bugsnag" Exploit PoC (simulated traversal) malicious_id="../../../etc/passwd" curl -X POST -d "event_id=$malicious_id" http://bugs.example.com/ingest
How Exploit
- Craft `event_id` with `../` sequences.
- Send via valid DSN-enabled request.
- Overwrite system files.
Protection from this CVE
- Update to fixed versions.
- Restrict DSN exposure.
- Use containerization.
Impact
- Arbitrary file overwrite.
- System compromise (non-containerized).
- Limited to container (if used).
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
