Executive brief
Gladys Assistant is a home automation platform that streams video from cameras. An incomplete security fix allows authenticated users to bypass file access restrictions and read arbitrary files from the server, potentially exposing sensitive configuration data, credentials, or private information stored on the host machine.
Technical details
A directory traversal vulnerability (CWE-22) exists in the HLS stream parameter validation logic where an incomplete regex patch for CVE-2023-43256 failed to properly constrain filename validation. Authenticated attackers can craft requests with path traversal sequences (e.g., "../") in stream filenames to bypass the AUTHORIZED_FILENAMES whitelist and access arbitrary files on the server. The vulnerable component is server/services/rtsp-camera/utils/validateStreamParams.js. No authentication bypass is required—only valid user credentials. The fix involves correcting the HLS chunk regex pattern to properly anchor and validate filename format.
Affected products
- Gladys Gladys Assistant 4.27.0 and prior
Timeline
- 2023-12-07: disclosed: Published to OSV/GitHub advisories
- 2023-10-30: patched: Fix applied in commit 4f56ba250ff9f46578f1afa6a97e62e74bad83b7 updating HLS chunk regex validation