Description
Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in the workspace field and subsequently use relative paths in the session file API to access any file readable by the WebUI process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nesquena hermes-webui
Default version status: affected
0 to < 0.51.44affectedf00cb74f776f22f02f5eb6b39dfb389f87cc7fd3unaffected
pkg:github/nesquena/hermes-webuiReferences
- https://github.com/nesquena/hermes-webui/releases/tag/v0.51.44 ↗
- https://github.com/nesquena/hermes-webui/pull/2048 ↗
- https://github.com/nesquena/hermes-webui/commit/f00cb74f776f22f02f5eb6b39dfb389f87cc7fd3 ↗
- https://www.vulncheck.com/advisories/hermes-webui-path-traversal-via-session-import-endpoint ↗