GHSA-9h6h-9g78-86f7 Yapscan's report receiver server vulnerable to path traversal and log injection

Not scored Published 29 Dec 2022

Attackers can overwrite arbitrary files on the host via path traversal in the experimental report receiver server, leading to data loss.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-9h6h-9g78-86f7?

GHSA-9h6h-9g78-86f7 is a path traversal vulnerability in github.com/fkie-cad/yapscan, published on 29 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Impact

If you make use of the report receiver server (experimental), a client may be able to forge requests such that arbitrary files on the host can be overwritten (subject to permissions of the yapscan server), leading to loss of data. This is particularly problematic if you do not authenticate clients and/or run the server with elevated permissions.

Patches

Vulnerable versions:

v0.18.0
v0.19.0 (unreleased)

This problem is patched in version v0.19.1

Workarounds

Update to the newer version is highly encouraged!

Measures to reduce the risk of this include authenticating clients (see --client-ca flag) and containerization of the yapscan server.

References

The tracking issue is #35. There you can find the commits, fixing the issue.

Which versions are affected by GHSA-9h6h-9g78-86f7?

3 open source packages ship an affected version, including github.com/fkie-cad/yapscan.

Package	Affected	Fixed in
`github.com/fkie-cad/yapscan` Go	From `0.18.0`	`0.19.1`
`github.com/fkie-cad/yapscan` Go	From `0.18.0`	`0.19.1`
`github.com/fkie-cad/yapscan` Go	From `0.18.0`	`0.19.1`

How do I fix GHSA-9h6h-9g78-86f7?

Upgrade github.com/fkie-cad/yapscan to 0.19.1 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is GHSA-9h6h-9g78-86f7 being exploited?

There is no known exploitation of GHSA-9h6h-9g78-86f7 in the wild and no public exploit code.

Sources

Also known as GO-2022-1204.