| タイトル | cemtan sar2html 4.0.0 Path Traversal |
|---|
| 説明 | sar2html 4.0.0 is affected by an unauthenticated path traversal
vulnerability (CWE-22) in the file upload endpoint.
The POST / route (function uploadFiles()) accepts .tar and .tar.gz
files from any remote user without requiring authentication. After
saving the uploaded file, it calls updateDb(), which extracts the
archive using Python's tarfile.extractall() without validating or
filtering the paths of the archive members:
with tarfile.open(s2dir + '/' + s2filename) as tar:
tar.extractall(path=s2tmp)
An attacker can craft a malicious tar archive containing members
with path traversal sequences (e.g. ../../etc/cron.d/backdoor,
../../root/.ssh/authorized_keys) to write arbitrary files outside
the intended extraction directory, anywhere the process has write
access.
The only input validation present is secure_filename() applied to
the outer archive filename — this does not affect the paths of
members inside the archive.
In typical deployments (Docker image running as root, as documented
in the official README), this vulnerability allows an unauthenticated
remote attacker to achieve Remote Code Execution by writing to
locations such as /etc/cron.d/ or by overwriting application files.
Affected component: sar2html.py, functions uploadFiles() and updateDb()
Attack vector: Network
Privileges required: None
User interaction: None
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N |
|---|
| ソース | ⚠️ https://github.com/cemtan/sar2html/issues/18 |
|---|
| ユーザー | spoo1k (UID 101695) |
|---|
| 送信 | 2026年09月28日 10:45 (17 日 ago) |
|---|
| モデレーション | 2026年10月14日 15:11 (16 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 419826 [cemtan sar2html 4.0.0 File Upload sar2html.py updateDb ディレクトリトラバーサル] |
|---|
| ポイント | 20 |
|---|