CVE-2024-55602
📋 TL;DR
This vulnerability in PwnDoc allows authenticated users with template update/download permissions to perform path traversal attacks by injecting '../' sequences into file extension properties. This enables reading arbitrary files on the server filesystem. Only authenticated users with specific template permissions are affected.
💻 Affected Systems
- PwnDoc
📦 What is this software?
Pwndoc by Pwndoc Project
⚠️ Risk & Real-World Impact
Worst Case
An attacker could read sensitive system files including configuration files, passwords, SSH keys, and other credentials, potentially leading to full system compromise.
Likely Case
Attackers with legitimate user accounts could exfiltrate sensitive report data, user information, or configuration details from the PwnDoc application directory.
If Mitigated
With proper access controls and network segmentation, impact would be limited to files accessible by the PwnDoc application user.
🎯 Exploit Status
Exploit requires authenticated access but is simple to execute once authentication is obtained. Public proof-of-concept available in GitHub gist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 or later
Vendor Advisory: https://github.com/pwndoc/pwndoc/security/advisories/GHSA-2mqc-gg7h-76p6
Restart Required: Yes
Instructions:
1. Update to latest PwnDoc version or apply commit 1d4219c596f4f518798492e48386a20c6e9a2fe6
2. Restart the PwnDoc application
3. Verify the fix by checking the template.js file contains proper path validation
🔧 Temporary Workarounds
Restrict Template Permissions
allRemove template update and download permissions from all non-admin users
Application Sandboxing
linuxRun PwnDoc in a container or chroot jail with minimal file system access
🧯 If You Can't Patch
- Implement strict access controls to limit which users can update/download templates
- Monitor file access logs for suspicious path traversal patterns
🔍 How to Verify
Check if Vulnerable:
Check if your PwnDoc version is prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 by examining the backend/src/routes/template.js file for path traversal validationCheck Version:
git log --oneline -1Verify Fix Applied:
Verify that backend/src/routes/template.js contains proper path sanitization and validation for file extension parameters📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from template endpoints
- Requests containing '../' sequences in template parameters
Network Indicators:
- Multiple template download requests with varying file extensions
SIEM Query:
source="pwndoc" AND (uri_path="/api/templates/*" AND (param="../" OR param="..\\"))🔗 References
- https://gist.github.com/JorianWoltjer/8a42e25c6dfa7604020d2a226e193407
- https://github.com/pwndoc/pwndoc/blob/2e7f5747d5688b1368e549c786ce7266fe5ab2b5/backend/src/routes/template.js#L103
- https://github.com/pwndoc/pwndoc/blob/2e7f5747d5688b1368e549c786ce7266fe5ab2b5/backend/src/routes/template.js#L43-L47
- https://github.com/pwndoc/pwndoc/commit/1d4219c596f4f518798492e48386a20c6e9a2fe6
- https://github.com/pwndoc/pwndoc/security/advisories/GHSA-2mqc-gg7h-76p6
- https://gist.github.com/JorianWoltjer/8a42e25c6dfa7604020d2a226e193407
- https://github.com/pwndoc/pwndoc/security/advisories/GHSA-2mqc-gg7h-76p6
