CVE-2022-45969
📋 TL;DR
CVE-2022-45969 is a directory traversal vulnerability in Alist v3.4.0 that allows attackers to access files outside the intended directory. This affects all users running the vulnerable version of Alist file listing software. Attackers can potentially read sensitive system files through improper path validation.
💻 Affected Systems
- Alist
📦 What is this software?
Alist by Alistgo
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive configuration files, credentials, or SSH keys leading to lateral movement and data exfiltration.
Likely Case
Unauthorized access to sensitive application files, configuration data, or user-uploaded content stored in adjacent directories.
If Mitigated
Limited impact with proper file permissions and network segmentation preventing access to critical system files.
🎯 Exploit Status
Directory traversal vulnerabilities are trivial to exploit with basic HTTP requests using path traversal sequences like ../
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.5.0 and later
Vendor Advisory: https://github.com/alist-org/alist/issues/2449
Restart Required: Yes
Instructions:
1. Stop Alist service. 2. Backup configuration. 3. Update to v3.5.0 or later. 4. Restart Alist service.
🔧 Temporary Workarounds
Web Server Path Restriction
allConfigure web server (nginx/apache) to reject requests containing directory traversal sequences
# nginx example: location ~ \.\./ { deny all; }
# apache example: RewriteRule \.\./ - [F]
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Alist from sensitive systems
- Apply strict file system permissions to limit accessible directories
🔍 How to Verify
Check if Vulnerable:
Test with curl: curl -v 'http://alist-server:port/api/path?path=../../../etc/passwd'Check Version:
Check Alist web interface or run: alist versionVerify Fix Applied:
Attempt same traversal test after patch - should return error or empty response📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing ../ sequences
- Access to unexpected file paths
- 403/404 errors for traversal attempts
Network Indicators:
- HTTP requests with encoded traversal sequences (%2e%2e%2f)
- Unusual file access patterns
SIEM Query:
web.url:*../* OR web.uri:*../*