CVE-2022-23602 Nim's rst parser sandboxed mode allows include which can embed any local file
An attacker can read arbitrary local files on the host server by exploiting the RST parser's include feature in Nimforum.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-23602?
CVE-2022-23602 is a high-severity path traversal vulnerability in n/a, published on 1 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nimforum is a lightweight alternative to Discourse written in Nim. In versions prior to 2.2.0 any forum user can create a new thread/post with an include referencing a file local to the host operating system. Nimforum will render the file if able. This can also be done silently by using NimForum's post "preview" endpoint. Even if NimForum is running as a non-critical user, the forum.json secrets can be stolen. Version 2.2.0 of NimForum includes patches for this vulnerability. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue.
Weakness: CWE-22
Which versions are affected by CVE-2022-23602?
It affects 2 products.
Products include Nim-Lang Docutils, Nim-Lang Nimforum.
How do I fix CVE-2022-23602?
No fix has been published for CVE-2022-23602 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-23602 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-23602 exists.
Sources
Also known as GHSA-q3vh-x957-wr75.