| 제목 | yohann( https://github.com/Yohann0617 ) oci-helper <=V3.2.4 Directory/Path Traversal |
|---|
| 설명 | A path traversal vulnerability exists in oci-helper version 3.2.4 and earlier in the OCI configuration upload functionality. The application fails to properly validate user-supplied filenames when processing file uploads through the /api/oci/addCfg endpoint. An authenticated attacker can exploit this vulnerability by uploading a file with a specially crafted filename containing path traversal sequences (e.g., ../../../), allowing arbitrary file write to any location on the server filesystem where the application has write permissions. Successful exploitation can lead to complete system compromise through SSH key replacement, configuration tampering, or malicious code injection via cron jobs. The vulnerability is present in the OciServiceImpl.addCfg() method at line 146, where MultipartFile.getOriginalFilename() is directly concatenated with the base directory path without sanitization. CVSS v3.1 Base Score: 8.1 (High) - AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. |
|---|
| 원천 | ⚠️ https://github.com/Xzzz111/exps/blob/main/archives/oci-helper-path-traversal-1/report.md |
|---|
| 사용자 | sh7err05 (UID 92498) |
|---|
| 제출 | 2025. 11. 10. PM 03:03 (11 개월 ago) |
|---|
| 모더레이션 | 2025. 12. 02. AM 10:35 (22 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 334031 [Yohann0617 oci-helper 까지 3.2.4 OCI Configuration Upload OciServiceImpl.java addCfg file 디렉토리 순회] |
|---|
| 포인트들 | 20 |
|---|