Description
Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ananthakumaran paisa
Default version status: unaffected
0 to < 0.7.8affected
References
- https://github.com/ananthakumaran/paisa/issues/420 ↗
- https://github.com/ananthakumaran/paisa ↗
- https://github.com/ananthakumaran/paisa/blob/v0.7.7/internal/server/editor.go#L49-L70 ↗
- https://github.com/ananthakumaran/paisa/commit/035949351f7c0d0f90ecf767aa1e28b4d5a0ae31 ↗
- https://github.com/ananthakumaran/paisa/releases/tag/v0.7.8 ↗
- https://www.vulncheck.com/advisories/paisa-before-0.7.8-path-traversal-via-editor-and-sheet-api ↗