# GHSA-7x4w-cj9r-h4v9: Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)

> An authenticated administrator can delete arbitrary files on the server via path traversal in the media controller, potentially causing denial of service or data loss.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** An administrator
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 18 Sep 2024

## What is GHSA-7x4w-cj9r-h4v9?

GHSA-7x4w-cj9r-h4v9 is a path traversal vulnerability in camaleon_cms, published on 18 Sep 2024. An attacker needs administrator access to exploit it, with no action from the victim.

### Official description

The [actions](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L51-L52) defined inside of the MediaController class do not check whether a given path is inside a certain path (e.g. inside the media folder). If an attacker performed an account takeover of an administrator account (See: GHSL-2024-184) they could delete arbitrary files or folders on the server hosting Camaleon CMS. The [crop_url](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L64-L65) action might make arbitrary file writes (similar impact to GHSL-2024-182) for any authenticated user possible, but it doesn't seem to work currently.

Arbitrary file deletion can be exploited with following code path: The parameter folder flows from the actions method:
```ruby
  def actions
    authorize! :manage, :media if params[:media_action] != 'crop_url'
    params[:folder] = params[:folder].gsub('//', '/') if params[:folder].present?
    case params[:media_action]
    [..]
    when 'del_file'
      cama_uploader.delete_file(params[:folder].gsub('//', '/'))
      render plain: ''
```
into the method delete_file of the CamaleonCmsLocalUploader class (when files are uploaded locally):
```ruby
def delete_file(key)
  file = File.join(@root_folder, key)
  FileUtils.rm(file) if File.exist? file
  @instance.hooks_run('after_delete', key)
  get_media_collection.find_by_key(key).take.destroy
end
```
Where it is joined in an unchecked manner with the root folder and then deleted.

**Proof of concept**
The following request would delete the file README.md in the top folder of the Ruby on Rails application. (The values for auth_token, X-CSRF-Token and _cms_session would also need to be replaced with authenticated values in the curl command below)
```
curl --path-as-is -i -s -k -X $'POST' \
    -H $'X-CSRF-Token: [..]' -H $'User-Agent: Mozilla/5.0' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Accept: */*' -H $'Connection: keep-alive' \
    -b $'auth_token=[..]; _cms_session=[..]' \
    --data-binary $'versions=&thumb_size=&formats=&media_formats=&dimension=&private=&folder=..%2F..%2F..%2FREADME.md&media_action=del_file' \
    $'https://<camaleon-host>/admin/media/actions?actions=true'
```
**Impact**
This issue may lead to a defective CMS or system.

**Remediation**
Normalize all file paths constructed from untrusted user input before using them and check that the resulting path is inside the targeted directory. Additionally, do not allow character sequences such as .. in untrusted input that is used to build paths.

**See also:**

[CodeQL: Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/ruby/rb-path-injection/)
[OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)

## Which versions are affected by GHSA-7x4w-cj9r-h4v9?

2 open source packages ship an affected version, including camaleon_cms.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `camaleon_cms` | RubyGems | All versions | 2.8.1 |
| `camaleon_cms` | RubyGems | All versions | 2.8.1 |

## How do I fix GHSA-7x4w-cj9r-h4v9?

Upgrade camaleon_cms to 2.8.1 or later.

## Is GHSA-7x4w-cj9r-h4v9 being exploited?

There is no known exploitation of GHSA-7x4w-cj9r-h4v9 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-7x4w-cj9r-h4v9 and fix it if it is affected.

What it is: GHSA-7x4w-cj9r-h4v9 is a path traversal vulnerability in camaleon_cms, published on 18 Sep 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-7x4w-cj9r-h4v9 in the wild and no public exploit code.

Affected packages and fixed versions:
- camaleon_cms (RubyGems): affected all versions; fixed in 2.8.1
- camaleon_cms (RubyGems): affected all versions; fixed in 2.8.1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-7x4w-cj9r-h4v9/ (Markdown: https://insights.sbomify.com/GHSA-7x4w-cj9r-h4v9/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-7x4w-cj9r-h4v9

---
From sbomify Insights: https://insights.sbomify.com/GHSA-7x4w-cj9r-h4v9/
Summaries are generated and may contain mistakes; the official description above is the record.