ShokoServer /api/Image/WithPath System.IO.File.OpenRead serverImagePath path traversal

Summaryinfo

A vulnerability was found in ShokoServer. It has been declared as critical. This vulnerability affects the function System.IO.File.OpenRead of the file /api/Image/WithPath. Such manipulation of the argument serverImagePath leads to path traversal. This vulnerability is listed as CVE-2023-43662. The attack may be performed from remote. There is no available exploit. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in ShokoServer (version now known). It has been rated as critical. Affected by this issue is the function System.IO.File.OpenRead of the file /api/Image/WithPath. The manipulation of the argument serverImagePath with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality. CVE summarizes:

ShokoServer is a media server which specializes in organizing anime. In affected versions the `/api/Image/WithPath` endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter `serverImagePath`, which is not sanitized in any way before being passed to `System.IO.File.OpenRead`, which results in an arbitrary file read. This issue may lead to an arbitrary file read which is exacerbated in the windows installer which installs the ShokoServer as administrator. Any unauthenticated attacker may be able to access sensitive information and read files stored on the server. The `/api/Image/WithPath` endpoint has been removed in commit `6c57ba0f0` which will be included in subsequent releases. Users should limit access to the `/api/Image/WithPath` endpoint or manually patch their installations until a patched release is made. This issue was discovered by the GitHub Security lab and is also indexed as GHSL-2023-191.

The weakness was presented 09/29/2023 as GHSA-mwcv-ghjq-8f2g. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2023-43662 since 09/20/2023. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

Applying the patch 6c57ba0f073d6be5a4f508c46c2ce36727cbce80 is able to eliminate this problem. The bugfix is ready for download at github.com.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• ShokoServer

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion