Executive brief
HashBrown CMS is a headless content management system used to manage and serve website content. This vulnerability allows an attacker to access files outside the intended directory by manipulating name or ID fields, potentially exposing sensitive configuration files, database contents, or other protected data on the server.
Technical details
The vulnerability is a path traversal (CWE-22) issue in HashBrown CMS versions before 1.3.2, specifically in the Server/Entity/Resource/Connection.js file. An attacker can craft malicious name or ID field values containing directory traversal sequences (e.g., "../") to access parent directories and read arbitrary files on the server. The attack requires network access to the CMS but no authentication or user interaction. The vulnerability was fixed in version 1.3.2 via path validation improvements.
Affected products
- HashBrown HashBrown CMS before 1.3.2
Timeline
- 2020-01-06: disclosed
- 2022-05-24: advisory
- 2020: patched: Fixed in version 1.3.2