CVE-2023-1800 sjqzhang go-fastdfs File Upload uploa upload path traversal
Remote attackers can exploit a path traversal flaw in the file upload handler to read or modify arbitrary files on the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-1800?
CVE-2023-1800 is a high-severity path traversal vulnerability in sjqzhang go-fastdfs, published on 2 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability, which was classified as critical, has been found in sjqzhang go-fastdfs up to 1.4.3. Affected by this issue is the function upload of the file /group1/uploa of the component File Upload Handler. The manipulation leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224768.
Which versions are affected by CVE-2023-1800?
3 open source packages ship an affected version, including github.com/sjqzhang/go-fastdfs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/sjqzhang/go-fastdfs Go | All versions | 1.4.5-0.20230408141131-61cbff5124c6 |
github.com/sjqzhang/go-fastdfs Go | All versions | 1.4.5-0.20230408141131-61cbff5124c6 |
github.com/sjqzhang/go-fastdfs Go | All versions | 1.4.5-0.20230408141131-61cbff5124c6 |
Products include Go-Fastdfs Project Go-Fastdfs.
How do I fix CVE-2023-1800?
Upgrade github.com/sjqzhang/go-fastdfs to 1.4.5-0.20230408141131-61cbff5124c6 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-1800 being exploited?
There is no known exploitation of CVE-2023-1800 in the wild and no public exploit code.
Sources
Also known as GHSA-xq3x-grrj-fj6x, GO-2023-1713.