CVE-2022-38638 Casdoor arbitrary file write vulnerability
Attackers can write arbitrary files via the upload-resource API, potentially leading to code execution or data modification in Casdoor.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-38638?
CVE-2022-38638 is a critical path traversal vulnerability in n/a, published on 9 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.
Weakness: CWE-22
Which versions are affected by CVE-2022-38638?
4 open source packages ship an affected version, including github.com/casdoor/casdoor and casdoor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/casdoor/casdoor Go | All versions | 1.103.1 |
github.com/casdoor/casdoor Go | All versions | 1.103.1 |
github.com/casdoor/casdoor Go | All versions | 1.103.1 |
casdoor PyPI | All versions to 1.97.3 | None |
Products include Casbin Casdoor.
How do I fix CVE-2022-38638?
Upgrade github.com/casdoor/casdoor to 1.103.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-38638 being exploited?
There is no known exploitation of CVE-2022-38638 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2024-41657 GHSL-2024-035: Casdoor CORS misconfiguration
- CVE-2022-44942 Casdoor arbitrary file deletion vulnerability via uploadFile function
- CVE-2024-41264 casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification
- CVE-2022-24124 SQL Injection in Casdoor
- CVE-2023-34927 Casdoor Cross-Site Request Forgery vulnerability
Sources
Also known as GHSA-9vm3-r8gq-cr6x, GO-2022-1006, PYSEC-2022-43190.