CVE-2024-31450 Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)

What is CVE-2024-31450?

CVE-2024-31450 is a low-severity path traversal vulnerability in owncast, published on 19 Apr 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory. This vulnerability is fixed in 0.1.3.

Weakness: CWE-22

Which versions are affected by CVE-2024-31450?

3 open source packages ship an affected version, including github.com/owncast/owncast. It affects 1 product.

Products include Owncast Project Owncast.

How do I fix CVE-2024-31450?

Upgrade github.com/owncast/owncast to 0.1.3 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-31450 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-31450 exists.

Other vulnerabilities in owncast

• CVE-2023-46480 OwnCast remote code execution vulnerability Critical 9.8
• CVE-2022-3751 SQL Injection in owncast/owncast High 8.8
• CVE-2023-3188 Server-Side Request Forgery (SSRF) in owncast/owncast High 8.3
• CVE-2024-29026 Owncast cross origin request High 8.2
• CVE-2021-39183 Unsafe inline XSS Owncast High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9355-27m8-h74v, GO-2024-2741.