CVE-2024-28335 Lektor does not sanitize database path traversal
An attacker can execute shell commands via path traversal in Lektor if a victim visits a malicious site while the local server is running.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-28335?
CVE-2024-28335 is a critical path traversal vulnerability in n/a, published on 27 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Lektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates directory, if the victim's web browser accesses an untrusted website that uses JavaScript to send requests to localhost port 5000, and the web browser is running on the same machine as the "lektor server" command.
Weakness: CWE-22
Which versions are affected by CVE-2024-28335?
5 open source packages ship an affected version, including lektor and Lektor.
| Package | Affected | Fixed in |
|---|---|---|
lektor PyPI | All versions | 3.3.11 |
lektor PyPI | All versions | 3.3.11 |
lektor PyPI | From 3.4.0b1 | 3.4.0b11 |
Lektor PyPI | All versions | 3.3.11 |
Lektor PyPI | From 3.4.0b1 | 3.4.0b11 |
How do I fix CVE-2024-28335?
Upgrade lektor to a fixed version for your release line: 3.3.11 or 3.4.0b11.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-28335 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-28335 exists.
Sources
Also known as GHSA-wv28-7fpw-fj49, PYSEC-2024-49, UBUNTU-CVE-2024-28335.