Listen to this Post
The vulnerability exists within the Attachment service of memos version v0.25.2. The service fails to properly sanitize or validate user-supplied filenames during the upload process. An attacker can craft a malicious filename containing directory traversal sequences, such as ../../../etc/passwd. When the application processes this filename, it does not verify if the resultant path escapes the intended attachment storage directory. This allows the attacker to write uploaded files to arbitrary locations on the server’s filesystem. The lack of validation occurs before the file is written to disk, meaning any checks on the final stored file are ineffective. Successful exploitation requires an account with upload privileges, but can lead to critical system file overwrite, remote code execution by writing to executable directories, or denial of service by corrupting system files.
Platform: memos
Version: v0.25.2
Vulnerability: Path Traversal
Severity: Moderate
date: 2024-12-08
Prediction: Patch 2024-12-20
What Undercode Say:
curl -X POST -H "Authorization: Bearer <JWT>" -F "[email protected];filename=../../../var/www/html/shell.php" http://memos-host/api/v1/resource/blob
// Vulnerable code likely resembles:
fileName := fileHeader.Filename
destinationPath := filepath.Join(attachmentPath, fileName)
// Missing validation for 'fileName'
os.WriteFile(destinationPath, fileData, 0644)
// Remediation patch:
baseName := filepath.Base(fileHeader.Filename)
if strings.Contains(baseName, "..") || strings.Contains(baseName, "/") || strings.Contains(baseName, "\") {
// Reject request
}
safePath := filepath.Join(attachmentPath, baseName)
How Exploit:
Attacker authenticates, uploads attachment with malicious filename containing `../` sequences, overwriting critical server files or planting web shell.
Protection from this CVE
Validate filename input. Use path.Base(). Restrict write permissions. Implement security middleware.
Impact:
Arbitrary File Write. Potential Remote Code Execution. System Compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
