Executive brief
ioBroker Admin is a web-based configuration and administration interface for the ioBroker home automation platform. The software contains a path traversal vulnerability in its log file handling that allows attackers to read and write arbitrary files on the server. Although authentication is normally required, it is disabled by default, putting unprotected systems at immediate risk of data theft and system compromise.
Technical details
The vulnerability is a path traversal (CWE-22) flaw in the /log/ route of ioBroker Admin versions prior to 3.6.12. The application fails to properly restrict access to directories outside the intended logging folder, allowing attackers to manipulate file paths using directory traversal sequences (e.g., ../) to access arbitrary files. An attacker can read sensitive files (confidentiality impact) or write malicious files (integrity impact) on the system. Authentication is required in principle, but is disabled by default in many deployments, effectively removing this precondition. The vulnerability was patched in version 3.6.12 with log path sanitization as documented in commit 16b2b32.
Affected products
- ioBroker Admin <3.6.12
Timeline
- 2019-10-09: disclosed: Path traversal vulnerability disclosed; patch released in version 3.6.8
- 2019-10-09: patched: Log paths were sanitized in version 3.6.8, with final fix in 3.6.12
- 2020-09-04: advisory: GHSA advisory published