CVE-2024-22050 Iodine Static File Server Path Traversal Vulnerability
An unauthenticated remote attacker can read files outside the public folder in the Iodine static file server via malicious URLs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-22050?
CVE-2024-22050 is a high-severity path traversal vulnerability in boazsegev:iodine, published on 4 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.
Weakness: CWE-22
Which versions are affected by CVE-2024-22050?
2 open source packages ship an affected version, including iodine. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
iodine RubyGems | All versions | 0.7.34 |
iodine RubyGems | All versions | 0.7.34 |
Products include Boazsegev Iodine.
How do I fix CVE-2024-22050?
Upgrade iodine to 0.7.34 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-22050 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-22050 exists.
Sources
Also known as GHSA-85rf-xh54-whp3.