Описание
Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read
Summary
Two unauthenticated path traversal vulnerabilities exist in Saltcorn's mobile sync endpoints. The POST /sync/offline_changes endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.json file with attacker-controlled JSON content anywhere on the server filesystem. The GET /sync/upload_finished endpoint allows an unauthenticated attacker to list arbitrary directory contents and read specific JSON files.
The safe path validation function File.normalise_in_base() exists in the codebase and is correctly used by the clean_sync_dir endpoint in the same file (fix for GHSA-43f3-h63w-p6f6), but was not applied to these two endpoints.
Details
Finding 1: Arbitrary file write — POST /sync/offline_changes (sync.js line 226)
The newSyncTimestamp parameter from the request body is used directly in path.join() without sanitization:
No authentication middleware is applied to this route. Since path.join() normalizes ../ sequences, setting newSyncTimestamp to ../../../../tmp/evil causes the path to resolve outside the sync directory.
Finding 2: Arbitrary directory read — GET /sync/upload_finished (sync.js line 288)
The dir_name query parameter is used directly in path.join() without sanitization:
Also unauthenticated. An attacker can list directory contents and read files named translated-ids.json, unique-conflicts.json, data-conflicts.json, or error.json from any directory.
Contrast — fixed endpoint in the same file (line 342):
The clean_sync_dir endpoint correctly uses File.normalise_in_base():
PoC
Impact
- Unauthenticated arbitrary directory creation anywhere on the filesystem
- Unauthenticated arbitrary JSON file write (
changes.json) to any writable directory - Unauthenticated directory listing of arbitrary directories
- Unauthenticated read of specific JSON files from arbitrary directories
- Potential for remote code execution via writing to sensitive paths (cron, systemd, Node.js module paths)
Remediation
Apply File.normalise_in_base() to both endpoints, matching the existing pattern in clean_sync_dir:
Additionally, add loggedIn middleware to endpoints that modify server state.
Пакеты
@saltcorn/server
< 1.4.5
1.4.5
@saltcorn/server
>= 1.5.0-beta.0, < 1.5.5
1.5.5
@saltcorn/server
>= 1.6.0-alpha.0, < 1.6.0-beta.4
1.6.0-beta.4
Связанные уязвимости
Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.5, 1.5.5, and 1.6.0-beta.4, the POST /sync/offline_changes endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.json file with attacker-controlled JSON content anywhere on the server filesystem. The GET /sync/upload_finished endpoint allows an unauthenticated attacker to list arbitrary directory contents and read specific JSON files. This vulnerability is fixed in 1.4.5, 1.5.5, and 1.6.0-beta.4.