Description
Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars directory and read .jpeg files belonging to other workspaces.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
colanode colanode
Default version status: unaffected
0 to ≤ 0.4.7affected
References
- https://hackmd.io/@hieuPenguinnn/colanode-avatar-download-path-traversal ↗
- https://github.com/colanode/colanode/blob/d649523637f0f059c936418488165d4a689da27c/apps/server/src/lib/storage/fs.ts#L38 ↗
- https://github.com/colanode/colanode/blob/d649523637f0f059c936418488165d4a689da27c/apps/server/src/api/client/routes/avatars/avatar-download.ts#L23 ↗
- https://github.com/colanode/colanode ↗
- https://www.vulncheck.com/advisories/colanode-server-through-0.4.7-path-traversal-via-avatar-download-route ↗