CVE-2020-19279
📋 TL;DR
CVE-2020-19279 is a directory traversal vulnerability in B3log Wide that allows attackers to access arbitrary files on the server via symbolic link manipulation. This can lead to privilege escalation by reading sensitive configuration files or system data. All users running vulnerable versions of B3log Wide are affected.
💻 Affected Systems
- B3log Wide
📦 What is this software?
Wide by Wide Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through reading sensitive files like /etc/passwd, SSH keys, or database credentials, leading to complete server takeover.
Likely Case
Unauthorized access to sensitive application files, configuration data, or user information stored on the server.
If Mitigated
Limited impact with proper file permissions and network segmentation preventing access to critical system files.
🎯 Exploit Status
Exploitation is straightforward using directory traversal sequences with symbolic links. Public GitHub issues demonstrate the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Latest version after the fix was implemented
Vendor Advisory: https://github.com/b3log/wide/issues/355
Restart Required: Yes
Instructions:
1. Update B3log Wide to the latest version. 2. Restart the Wide service. 3. Verify the fix by testing directory traversal attempts.
🔧 Temporary Workarounds
Restrict File Access
linuxConfigure file system permissions to limit Wide's access to only necessary directories
chmod -R 750 /path/to/wide/data
chown -R wide:wide /path/to/wide/data
Web Server Filtering
allConfigure reverse proxy or web server to block requests containing directory traversal sequences
🧯 If You Can't Patch
- Implement strict file system permissions and run Wide with minimal privileges
- Deploy network segmentation and restrict Wide's network access to only required services
🔍 How to Verify
Check if Vulnerable:
Test if you can access files outside the intended directory by requesting paths like ../../etc/passwd via the Wide interfaceCheck Version:
Check Wide version in application interface or configuration filesVerify Fix Applied:
Attempt the same directory traversal tests after patching - they should return 403 or 404 errors📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing ../ sequences
- Access to unexpected file paths in application logs
- 403/404 errors for traversal attempts
Network Indicators:
- HTTP requests with encoded directory traversal payloads (%2e%2e%2f)
- Unusual file access patterns from single IPs
SIEM Query:
source="wide.logs" AND ("..\/" OR "%2e%2e%2f" OR "../../")