CVE-2022-44942 Casdoor arbitrary file deletion vulnerability via uploadFile function
An attacker can delete arbitrary files via the uploadFile function in Casdoor, potentially compromising system integrity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-44942?
CVE-2022-44942 is a high-severity path traversal vulnerability in n/a, published on 7 Dec 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function.
Weakness: CWE-22
Which versions are affected by CVE-2022-44942?
3 open source packages ship an affected version, including github.com/casdoor/casdoor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/casdoor/casdoor Go | All versions | 1.126.1 |
github.com/casdoor/casdoor Go | All versions | 1.126.1 |
github.com/casdoor/casdoor Go | All versions | 1.126.1 |
Products include Casbin Casdoor.
How do I fix CVE-2022-44942?
Upgrade github.com/casdoor/casdoor to 1.126.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-44942 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-44942 exists.
Other vulnerabilities in n/a
- CVE-2022-38638 Casdoor arbitrary file write vulnerability
- CVE-2024-41657 GHSL-2024-035: Casdoor CORS misconfiguration
- CVE-2024-41264 casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification
- CVE-2022-24124 SQL Injection in Casdoor
- CVE-2023-34927 Casdoor Cross-Site Request Forgery vulnerability
Sources
Also known as GHSA-f93f-55c2-8c89, GO-2022-1153.