Description
Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmite__/config, and /__marmite__/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in handle_create_content and handle_clone_content to write files outside the project directory via directory traversal.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
rochacbruno marmite
Default version status: unaffected
0 to ≤ 0.4.2affected
pkg:cargo/marmiteReferences
- https://github.com/rochacbruno/marmite/issues/554 ↗
- https://github.com/rochacbruno/marmite/blob/4b2ddbd7595233b2e1d0086e18490fec49705098/src/server.rs#L455-L475 ↗
- https://github.com/rochacbruno/marmite/blob/4b2ddbd7595233b2e1d0086e18490fec49705098/src/content.rs#L1064-L1075 ↗
- https://github.com/rochacbruno/marmite/blob/4b2ddbd7595233b2e1d0086e18490fec49705098/src/content.rs#L1300-L1322 ↗
- https://github.com/rochacbruno/marmite/commit/303a0bf2fff4302f4164c0c39932fdffc6683ad4 ↗
- https://github.com/rochacbruno/marmite ↗
- https://www.vulncheck.com/advisories/marmite-through-0.4.2-unauthenticated-api-access-via-development-server ↗