Description
gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
flipped-aurora gin-vue-admin
Default version status: unaffected
0 to ≤ 2.9.2affected
pkg:golang/github.com/flipped-aurora/gin-vue-admin/serverReferences
- https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-mqv7-9mvf-h9fh ↗
- https://github.com/flipped-aurora/gin-vue-admin/blob/v2.9.2-stable/server/service/system/auto_code_plugin.go#L371-L390 ↗
- https://github.com/flipped-aurora/gin-vue-admin/blob/v2.9.2-stable/server/api/v1/system/auto_code_plugin.go#L209-L219 ↗
- https://www.vulncheck.com/advisories/gin-vue-admin-through-2.9.2-path-traversal-via-removeplugin-endpoint ↗