CVE-2023-36819 Knowage-Server vulnerable to Path traversal in download functionalities

Medium 6.5 Published 3 Jul 2023 Updated 22 Nov 2024

Authenticated attackers can exploit path traversal in Knowage-Server to download arbitrary files, including sensitive configuration data.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-36819?

CVE-2023-36819 is a medium-severity path traversal vulnerability in KnowageLabs Knowage-Server, published on 3 Jul 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems. The endpoint `_/knowage/restful-services/dossier/importTemplateFile_` allows authenticated users to download template hosted on the server. However, starting in the 6.x.x branch and prior to version 8.1.8, the application does not sanitize the `_templateName_ `parameter allowing an attacker to use `*../*` in it, and escaping the directory the template are normally placed and download any file from the system. This vulnerability allows a low privileged attacker to exfiltrate sensitive configuration file. This issue has been patched in Knowage version 8.1.8.

Weakness: CWE-22

Which versions are affected by CVE-2023-36819?

It affects 1 product.

Products include Eng Knowage.

How do I fix CVE-2023-36819?

No fix has been published for CVE-2023-36819 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-36819 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-36819 exists.

Sources

Also known as GHSA-jw99-hxxj-75g2.