Description
Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlled JSON content to filesystem paths. Attackers can supply path traversal sequences in the uploaded document's _id field to escape the intended directory and write files with .json extension to arbitrary locations as root.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
StamusNetworks scirius
Default version status: unaffected
0 to ≤ 3.8.0affected
References
- https://github.com/geo-chen/oss/blob/main/scirius.md ↗
- https://github.com/StamusNetworks/scirius ↗
- https://github.com/StamusNetworks/scirius/blob/3bb49d383f4801b79e6356f9de9f25806afe0311/suricata/rest_api.py#L105-L113 ↗
- https://www.vulncheck.com/advisories/scirius-through-3.8.0-arbitrary-file-write-via-pcap-upload ↗