CVE-2023-27577 Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarum

What is CVE-2023-27577?

CVE-2023-27577 is a medium-severity vulnerability in flarum framework, published on 10 Mar 2023.

Official description

flarum is a forum software package for building communities. In versions prior to 1.7.0 an admin account which has already been compromised by an attacker may use a vulnerability in the `LESS` parser which can be exploited to read sensitive files on the server through the use of path traversal techniques. An attacker can achieve this by providing an absolute path to a sensitive file in the custom `LESS` setting, which the `LESS` parser will then read. For example, an attacker could use the following code to read the contents of the `/etc/passwd` file on a linux machine. The scope of what files are vulnerable will depend on the permissions given to the running flarum process. The vulnerability has been addressed in version `1.7`. Users should upgrade to this version to mitigate the vulnerability. Users unable to upgrade may mitigate the vulnerability by ensuring that their admin accounts are secured with strong passwords and follow other best practices for account security. Additionally, users can limit the exposure of sensitive files on the server by implementing appropriate file permissions and access controls at the operating system level.

Weakness: CWE-22

Which versions are affected by CVE-2023-27577?

2 open source packages ship an affected version, including flarum/core. It affects 1 product.

Products include Flarum Flarum.

How do I fix CVE-2023-27577?

Upgrade flarum/core to 1.7.0 or later.

Is CVE-2023-27577 being exploited?

There is no known exploitation of CVE-2023-27577 in the wild and no public exploit code.

Other vulnerabilities in flarum framework

• CVE-2021-32671 XSS vulnerability with translator Critical 10.0
• CVE-2022-41938 Cross site scripting vulnerability with discussion titles in flarum Critical 9.0
• CVE-2019-13183 Cross-site request forgery in n/a High 8.8
• CVE-2023-22487 Post mentions can be used to read any post on the forum without access control High 7.7
• CVE-2019-11514 Flarum mishandles invalidation of user email tokens High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vhm8-wwrf-3gcw.