CVE-2020-8144 Path traversal in UniFi Video Controller (for Windows 7/8/10 x64)

High 8.4 Published 1 Apr 2020 Updated 4 Aug 2024

Attackers can manipulate firmware update paths to write files outside the intended directory, potentially leading to arbitrary file write or code execution.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-8144?

CVE-2020-8144 is a high-severity path traversal vulnerability in UniFi Video Controller (for Windows 7/8/10 x64), published on 1 Apr 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The UniFi Video Server v3.9.3 and prior (for Windows 7/8/10 x64) web interface Firmware Update functionality, under certain circumstances, does not validate firmware download destinations to ensure they are within the intended destination directory tree. It accepts a request with a URL to firmware update information. If the version field contains ..\ character sequences, the destination file path to save the firmware can be manipulated to be outside the intended destination directory tree. Fixed in UniFi Video Controller v3.10.3 and newer.

Weakness: CWE-22

Which versions are affected by CVE-2020-8144?

It affects 1 product.

Products include Ui Unifi Video.

How do I fix CVE-2020-8144?

No fix has been published for CVE-2020-8144 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2020-8144 being exploited?

There is no known exploitation of CVE-2020-8144 in the wild and no public exploit code.

Sources

Also known as GHSA-8vc5-gg9h-3rv8.