GrowthBook prior 2022-08-29 path traversal

Summaryinfo

A vulnerability classified as critical has been found in GrowthBook. This affects an unknown part. This manipulation causes path traversal. This vulnerability appears as CVE-2022-36065. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in GrowthBook and classified as critical. Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-24. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

GrowthBook is an open-source platform for feature flagging and A/B testing. With some self-hosted configurations in versions prior to 2022-08-29, attackers can register new accounts and upload files to arbitrary directories within the container. If the attacker uploads a Python script to the right location, they can execute arbitrary code within the container. To be affected, ALL of the following must be true: Self-hosted deployment (GrowthBook Cloud is unaffected); using local file uploads (as opposed to S3 or Google Cloud Storage); NODE_ENV set to a non-production value and JWT_SECRET set to an easily guessable string like `dev`. This issue is patched in commit 1a5edff8786d141161bf880c2fd9ccbe2850a264 (2022-08-29). As a workaround, set `JWT_SECRET` environment variable to a long random string. This will stop arbitrary file uploads, but the only way to stop attackers from registering accounts is by updating to the latest build.

The weakness was presented 09/07/2022 as GHSA-j24q-55xh-wm4r. The advisory is shared at github.com. This vulnerability is known as CVE-2022-36065 since 07/15/2022. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading to version 2022-08-29 eliminates this vulnerability. Applying the patch 1a5edff8786d141161bf880c2fd9ccbe2850a264 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• GrowthBook

License

• open-source

Website

• Product: https://github.com/growthbook/growthbook/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion