Executive brief
Saltcorn Server is an open-source no-code application builder. An authenticated user of any role can exploit a path traversal flaw in the sync endpoint to delete arbitrary files from the server's filesystem. By crafting malicious requests with path traversal sequences (../ segments), an attacker can escape the intended sync directory and delete critical system or application files, potentially causing service disruption or data loss.
Technical details
The vulnerability is a classic path traversal (CWE-22) flaw in the sync/clean_sync_dir endpoint. The dir_name parameter from POST request body is directly concatenated into a path.join() call without validation or sanitization, and then passed to fs.rm() with recursive and force flags enabled. An attacker can include path traversal sequences like /../../../ in the dir_name parameter to escape the intended mobile_app/sync directory root and delete files elsewhere on the filesystem. The attack requires authentication (any user role suffices) and network access to the endpoint, but no CSRF token bypass or additional privileges. The fix, released in version 1.0.0-beta.16, normalizes the resolved path and validates it stays within the intended directory.
Affected products
- Saltcorn @saltcorn/server <=1.0.0-beta.15
Timeline
- 2024-10-07: disclosed: Advisory published on GitHub
- 2024-10-08: patched: Fix applied in version 1.0.0-beta.16