| 标题 | Mereithhh VanBlog 0.54.0 Path Traversal to RCE |
|---|
| 描述 | VanBlog (NestJS + MongoDB self-hosted blog) does not sanitize the path parameters of its
custom page endpoints. On the released version 0.54.0 two primitives are available to any
administrator session:
1) Arbitrary file read:
GET /api/admin/customPage/file?path=/&key=../../../../etc/passwd
returns the contents of /etc/passwd. local.provider.ts:48 calls
fs.readFileSync(path.join(staticPath, 'customPage', p, subPath)) and path.join resolves
the ../ sequences, so any file readable by the process can be read (caddy.json, database
credentials, files under /root).
2) Arbitrary file write:
POST /api/admin/customPage/upload?path=/&name=../../../../etc/x
returns HTTP 201 and writes the uploaded bytes to the resolved path
(local.provider.ts:80, fs.writeFileSync on the same join). Writes to /app, /etc and /root
were verified, and the process runs as root (uid=0).
The image startup chain is /app/entrypoint.sh -> node start.js -> spawn("node", ["main.js"],
{cwd: "/app/server"}), therefore overwriting /app/server/main.js and restarting the container
executes attacker code as root. Verified output: "id: uid=0(root) gid=0(root) ..." and a full
"ls /" directory listing from inside the container.
The attack can be made self-restoring: the original main.js is first retrieved with the read
primitive and saved as main.orig.js with the write primitive; the payload executes the
requested commands and then spawns node main.orig.js, so the site keeps serving normally
(HTTP 200 afterwards) and the compromise is hard to notice.
The vendor fixed the issue on the master branch only (new utils/customPagePath.ts providing
normalizeCustomPageRel / resolveCustomPageAbs, together with regression tests in
customPagePath.spec.ts and customPage.provider.upload.spec.ts); the same requests return
HTTP 403 with the message for an invalid path on master. No fixed release has been published:
0.54.0 is still the latest version and the official Docker image remains affected.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1 (Critical); chained with the stored XSS
issue the starting point drops to PR:L, giving 9.3. CWE-22, CWE-434, CWE-269. |
|---|
| 来源 | ⚠️ http://note.geronimo.xin/post/71 |
|---|
| 用户 | Geronimo (UID 102234) |
|---|
| 提交 | 2026-10-19 13時49分 (25 日前) |
|---|
| 管理 | 2026-11-13 21時03分 (25 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 437298 [Mereithhh VanBlog 直到 0.54.0 Custom Page local.provider.ts fs.readFileSync path 目录遍历] |
|---|
| 积分 | 19 |
|---|