CVE-2023-35844
📋 TL;DR
This vulnerability in Lightdash allows attackers to perform directory traversal attacks through insecure file endpoints. Attackers can access arbitrary files on the server by using '..' sequences and bypass file extension restrictions. All Lightdash instances before version 0.510.3 are affected.
💻 Affected Systems
- Lightdash
📦 What is this software?
Lightdash by Lightdash
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through arbitrary file read/write, potentially leading to sensitive data exposure, credential theft, or remote code execution.
Likely Case
Unauthorized access to sensitive files containing configuration data, credentials, or user data stored on the server.
If Mitigated
Limited impact with proper file system permissions and network segmentation, but still potential for information disclosure.
🎯 Exploit Status
Directory traversal attacks are well-understood and typically easy to exploit with basic HTTP requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.510.3
Vendor Advisory: https://github.com/lightdash/lightdash/security/advisories
Restart Required: Yes
Instructions:
1. Update Lightdash to version 0.510.3 or later. 2. Restart the Lightdash service. 3. Verify the fix by checking the version and testing file endpoints.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to Lightdash file endpoints using firewall rules or reverse proxy configurations.
File System Permissions Hardening
linuxApply strict file system permissions to limit what files Lightdash can access.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all file path parameters
- Deploy a web application firewall (WAF) with directory traversal protection rules
🔍 How to Verify
Check if Vulnerable:
Check if Lightdash version is below 0.510.3. Test file endpoints with directory traversal payloads like '../../etc/passwd'.Check Version:
Check Lightdash web interface settings or run: docker inspect lightdash_lightdash | grep -i versionVerify Fix Applied:
After updating to 0.510.3+, test that directory traversal attempts are properly blocked and return appropriate error responses.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '..' sequences in file paths
- Unusual file access patterns from unexpected IP addresses
- Error logs showing blocked path traversal attempts
Network Indicators:
- HTTP requests with encoded directory traversal sequences (%2e%2e%2f)
- Multiple failed attempts to access restricted file paths
SIEM Query:
source="lightdash.logs" AND (http_uri="*..*" OR http_uri="*%2e%2e*")🔗 References
- https://advisory.dw1.io/59
- https://github.com/lightdash/lightdash/commit/fcc808c84c2cc3afb343063e32a49440d32a553c
- https://github.com/lightdash/lightdash/compare/0.510.2...0.510.3
- https://github.com/lightdash/lightdash/pull/5090
- https://advisory.dw1.io/59
- https://github.com/lightdash/lightdash/commit/fcc808c84c2cc3afb343063e32a49440d32a553c
- https://github.com/lightdash/lightdash/compare/0.510.2...0.510.3
- https://github.com/lightdash/lightdash/pull/5090
