CVE-2024-36814 Adguard Home arbitrary file read vulnerability
Authenticated attackers can read arbitrary files as root on the underlying OS via a crafted file in a readable directory.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-36814?
CVE-2024-36814 is a medium-severity path traversal vulnerability in n/a, published on 8 Oct 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An arbitrary file read vulnerability in Adguard Home before v0.107.52 allows authenticated attackers to access arbitrary files as root on the underlying Operating System via placing a crafted file into a readable directory.
Weakness: CWE-22
Which versions are affected by CVE-2024-36814?
3 open source packages ship an affected version, including github.com/AdguardTeam/AdGuardHome.
| Package | Affected | Fixed in |
|---|---|---|
github.com/AdguardTeam/AdGuardHome Go | All versions | 0.107.53 |
github.com/AdguardTeam/AdGuardHome Go | All versions | 0.107.53 |
github.com/AdguardTeam/AdGuardHome Go | All versions | 0.107.53 |
How do I fix CVE-2024-36814?
Upgrade github.com/AdguardTeam/AdGuardHome to 0.107.53 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-36814 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-36814 exists.
Sources
Also known as GHSA-9cp9-8gw2-8v7m, GO-2024-3184.