Junglewise Threat Intelligence

CVE-2023-28458: PYSEC-2023-40 - pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the overwriting (with the st

CVE-2023-28458 · Severity: low · CVSS 3.1 · Published 2023-04-20

Technologies: pretalx (PyPI). Vendors: PyPI.

Executive brief

pretalx is an open-source conference management platform used to organize talks and schedules. A path traversal vulnerability in the HTML export feature allows organizers with administrative access to overwrite arbitrary files on the server with default error page content, potentially disrupting service or replacing important system files.

Technical details

A path traversal vulnerability (CWE-22) exists in pretalx's static HTML export functionality, affecting version 2.3.1. The vulnerability is located in the export_schedule_html.py management command, where insufficient path sanitization allows authenticated organizers to specify arbitrary file paths during export. An attacker with organizer privileges can craft malicious export requests to overwrite files outside the intended export directory with the standard pretalx 404 page content. The vulnerability requires authentication as an organizer and is triggered via the HTML export feature (a non-default capability). A patch is available in version 2.3.2 and later.

Affected products

  • pretalx pretalx 2.3.1

Timeline

  • 2023-04-20: disclosed: GHSA-23fx-92m6-4f2g and CVE-2023-28458 published
  • 2023-04-20: patched: Fix released in pretalx v2.3.2

References

Related threats