IceWhaleTech ZimaOS up to 1.2.4 on x86-64 API Endpoint /v3/file?token files path traversal

Summaryinfo

A vulnerability has been found in IceWhaleTech ZimaOS up to 1.2.4 on x86-64 and classified as critical. Impacted is an unknown function of the file /v3/file?token of the component API Endpoint. Performing a manipulation of the argument files results in path traversal. This vulnerability is identified as CVE-2024-48931. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in IceWhaleTech ZimaOS up to 1.2.4 on x86-64. This affects an unknown part of the file /v3/file?token of the component API Endpoint. The manipulation of the argument files with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality. The summary by CVE is:

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the ZimaOS API endpoint `http:///v3/file?token=&files=` is vulnerable to arbitrary file reading due to improper input validation. By manipulating the `files` parameter, authenticated users can read sensitive system files, including `/etc/shadow`, which contains password hashes for all users. This vulnerability exposes critical system data and poses a high risk for privilege escalation or system compromise. The vulnerability occurs because the API endpoint does not validate or restrict file paths provided via the `files` parameter. An attacker can exploit this by manipulating the file path to access sensitive files outside the intended directory. As of time of publication, no known patched versions are available.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2024-48931 since 10/10/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading to version 1.2.4 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• IceWhaleTech

Name

• ZimaOS

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4

Website

• Product: https://github.com/IceWhaleTech/ZimaOS/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

Video

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion