Listen to this Post
The vulnerability exists in the `list_folders()` function within the `/folder/dir-browser` API endpoint. This endpoint accepts POST requests with a “folder” parameter in the JSON body. The function uses `pathlib.Path()` to create a path object from the user-supplied input without sanitizing directory traversal sequences. When the path does not exist, the code prepends a “/” to the path, but this operation does not neutralize sequences like ../. For example, if an attacker submits {"folder":"/music/../proc/self/"}, the code creates PosixPath('../../../../etc'), checks for existence, and then incorrectly forms `PosixPath(‘/../../../../etc’)` when not found, still allowing traversal. Any authenticated user, including those without administrative privileges, can exploit this flaw. The server then returns a directory listing from the traversed location, such as /proc/self/, exposing sensitive filesystem information. The lack of authorization checks on the endpoint permits all authenticated sessions to access this functionality. The improper path handling fails to restrict the user to intended directories, enabling arbitrary filesystem exploration.
DailyCVE Form:
Platform: Swing Music
Version: Not specified
Vulnerability: Directory Traversal
Severity: Critical
Date: Not specified
Prediction: No patch yet
What Undercode Say:
Analytics:
curl --path-as-is -i -s -k -X $'POST' -H $'Content-Type: application/json' -b $'access_token_cookie=non-admin-access-token' --data-binary $'{\"folder\":\"/music/../proc/self/\", \"tracks_only\":false}' $'http://IP:1970/folder/dir-browser'
How Exploit:
Authenticate as non-admin user. Send POST request with traversal sequences in “folder” parameter. List arbitrary server directories.
Protection from this CVE:
Implement path sanitization. Add authorization checks. Restrict to allowed directories.
Impact:
Information disclosure. System layout exposure. Further attack preparation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
