Owncast up to 0.1.2 Administrator API /api/admin path traversal

Summaryinfo

A vulnerability was found in Owncast up to 0.1.2. It has been declared as critical. The affected element is an unknown function of the file /api/admin of the component Administrator API. Executing a manipulation can lead to path traversal. This vulnerability is tracked as CVE-2024-31450. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Owncast up to 0.1.2 and classified as problematic. This vulnerability affects some unknown processing of the file /api/admin of the component Administrator API. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect availability. CVE summarizes:

Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory. This vulnerability is fixed in 0.1.3.

The advisory is shared for download at securitylab.github.com. This vulnerability was named CVE-2024-31450 since 04/03/2024. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 0.1.3 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 1b14800c7d7f54be14ed4d130bfe7f480645076e is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Owncast

Version

• 0.1.0
• 0.1.1
• 0.1.2

License

• open-source

Website

• Product: https://github.com/owncast/owncast/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion