Executive brief
The Assemblyline 4 service client, which facilitates communication between analysis services and the central platform, is vulnerable to a file-writing flaw. A compromised server or an attacker positioned on the local network could force the client to write malicious files to sensitive locations on the host system. This could lead to system corruption or allow an attacker to gain persistent control over the machine running the client.
Technical details
A relative path traversal vulnerability (CWE-23) exists in `assemblyline_service_client/task_handler.py` within the `download_file()` function. The client accepts a 'sha256' string from the service-server JSON response and uses it directly in `os.path.join(self.tasking_dir, sha256)` without validation. An attacker controlling the server or performing a Man-in-the-Middle (MitM) attack can provide a traversal string (e.g., `../../../etc/cron.d/evil`) to write arbitrary data to the client's filesystem. While typically mitigated by containerization in standard deployments, standalone use of the client allows for potential remote code execution via overwritten system files. The issue is fixed in versions 4.6.0.stable11 and 4.6.1.dev138.
Affected products
- CybercentreCanada assemblyline-service-client < 4.6.0.stable11, >= 4.6.1.dev0 < 4.6.1.dev138
Timeline
- 2025-07-25: disclosed
- 2025-07-25: advisory
- 2025-07-25: patched
References
- https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865
- https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900
- https://api.github.com/repos/CybercentreCanada/assemblyline/security-advisories/GHSA-75jv-vfxf-3865