Overleaf up to 4.2.6/5.0.6 bin/upgrade Language improper restriction of names for files and other resources

Summaryinfo

A vulnerability categorized as problematic has been discovered in Overleaf up to 4.2.6/5.0.6. This impacts an unknown function of the file bin/upgrade. Executing a manipulation of the argument Language can lead to improper restriction of names for files and other resources. This vulnerability is registered as CVE-2024-45312. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Overleaf up to 4.2.6/5.0.6 and classified as problematic. This vulnerability affects an unknown functionality of the file bin/upgrade. The manipulation of the argument language with an unknown input leads to a improper restriction of names for files and other resources vulnerability. The CWE definition for the vulnerability is CWE-641. The product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name. As an impact it is known to affect confidentiality. CVE summarizes:

Overleaf is a web-based collaborative LaTeX editor. Overleaf Community Edition and Server Pro prior to version 5.0.7 (or 4.2.7 for the 4.x series) contain a vulnerability that allows an arbitrary language parameter in client spelling requests to be passed to the `aspell` executable running on the server. This causes `aspell` to attempt to load a dictionary file with an arbitrary filename. File access is limited to the scope of the overleaf server. The problem is patched in versions 5.0.7 and 4.2.7. Previous versions can be upgraded using the Overleaf toolkit `bin/upgrade` command. Users unable to upgrade may block POST requests to `/spelling/check` via a Web Application Firewall will prevent access to the vulnerable spell check feature. However, upgrading is advised.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-45312 since 08/26/2024. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading to version 4.2.7 or 5.0.7 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Overleaf

Version

• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5
• 4.2.6
• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6

Website

• Product: https://github.com/overleaf/overleaf/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion