CVE-2024-47818: Saltcorn Server path traversal in sync endpoint

CVE-2024-47818 · Severity: low · CVSS 3.1 · Published 2024-10-07

Saltcorn Server is an open-source no-code application builder. An authenticated user of any role can exploit a path traversal flaw in the sync endpoint to delete arbitrary files from the server's filesystem. By crafting malicious requests with path traversal sequences (../ segments), an attacker can escape the intended sync directory and delete critical system or application files, potentially causing service disruption or data loss.

Technologies: @saltcorn/server (npm), Saltcorn. Vendors: npm, Saltcorn.

Quick answers

Is CVE-2024-47818 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-47818 being exploited in the wild.
How severe is CVE-2024-47818?
Low severity, with a CVSS score of 3.1, published 7 October 2024.
Which products and versions are affected?
@saltcorn/server (npm) SEMVER:introduced=0,fixed=1.0.0-beta.16; Saltcorn <=1.0.0-beta.15.
Is there a fix for CVE-2024-47818?
Yes. @saltcorn/server (npm): upgrade to 1.0.0-beta.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-47818 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-47818?
Check whether you run @saltcorn/server (npm) or Saltcorn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @saltcorn/server (npm): upgrade to 1.0.0-beta.16 or later
    npm install @saltcorn/server@1.0.0-beta.16

Technical details

The vulnerability is a classic path traversal (CWE-22) flaw in the sync/clean_sync_dir endpoint. The dir_name parameter from POST request body is directly concatenated into a path.join() call without validation or sanitization, and then passed to fs.rm() with recursive and force flags enabled. An attacker can include path traversal sequences like /../../../ in the dir_name parameter to escape the intended mobile_app/sync directory root and delete files elsewhere on the filesystem. The attack requires authentication (any user role suffices) and network access to the endpoint, but no CSRF token bypass or additional privileges. The fix, released in version 1.0.0-beta.16, normalizes the resolved path and validates it stays within the intended directory.

Affected products

  • Saltcorn @saltcorn/server <=1.0.0-beta.15

Identifiers

  • CVE-2024-47818
  • GHSA-43f3-h63w-p6f6

Timeline

  • 2024-10-07: disclosed: Advisory published on GitHub
  • 2024-10-08: patched: Fix applied in version 1.0.0-beta.16

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.