Skip to content

Path Traversal Vulnerability in panorama.pm

Moderate
sni published GHSA-vhqc-649h-994h Jun 8, 2023

Package

panorama.pm (Perl)

Affected versions

<= 3.06

Patched versions

3.06-2

Description

Summary

The file panorama.pm is vulnerable to a Path Traversal Vulnerability which allows a remote authenticated attacker to upload arbitrary files to any folder which has write permissions on the affected system. This vulnerability affects all versions of Thruk even the one that was recently published (<=3.06).

Details

The parameter location is not filtered, validated or sanitized and it accepts any kind of characters. For a path traversal attack, the only characters required were the dot (.) and the slash (/).

In this step, the location is received from the parameters sent by the client through the web request and there is no sanitization at all.

my $location = $c->req->parameters->{'location'};

Then, the variable folder is constructed doing a basic concatenation without any sanitization.

my $folder = $c->stash->{'usercontent_folder'}.'/'.$location;

Next, the folder variable is concatenated with the filename variable and its result is stored in the newlocation variable, again no sanitization at all.

my $newlocation = $folder.'/'.$filename;

Finally, here the uploaded file is moved to the desired folder.

move($upload->{'tempname'}, $newlocation);

Through this flow, it is easy to see that due to the lack of sanitization we can manipulate the location parameter and exploit a Path Traversal vulnerability to upload a file to any folder we want.

PoC

  1. Go to the form where we can upload an image that will be used as background for a Dashboard.
  2. Select any file with the allowed extensions and intercept the request with Burp Suite.
  3. Modify the location parameter which is the backgrounds/ string and replace it with something like backgrounds/../../../../tmp/
  4. You will receive a message that the file was uploaded successfully.
  5. Check your /tmp/ folder and verify the presence of the file.

As part of the PoC, I decided to include the following screenshots.

In the first screenshot I included the normal request where a file will be uploaded to a folder where the current user does not have any write permissions, and I received an error message.
1 Thruk-Normal-Behavior

In the second screenshot I included the manipulated request where the path traversal vulnerability is being exploited to upload the file to /tmp/ folder, as you can see I received a success message.
2 Thruk-Path-Traversal-Exploitation

Impact

A Path Traversal vulnerability allows an attacker to upload arbitrary files to the server. The attacker can overwrite existing files on the system and cause a defacement (replacing legitimate images on the web server) or simply can upload random files to fill the disk completely and affect the availability and correct status of the platform.
It is well known that a Path Traversal Vulnerability in certain cases can allow an attacker to upload a webshell and gain Remote Code Execution (RCE) on the affected host, which could lead to a Complete System Takeover.
This vulnerability affects all versions of Thruk even the one that was recently published (3.06) so the impact is bigger as this issue affects all instances of Thruk around the world.

Timeline

  • 2023-05-25: This vulnerability was identified by Galoget Latorre.
  • 2023-06-02: Initial contact with maintainer via GitHub Security Advisory including vulnerability details and Proof of Concept (PoC).
  • 2023-06-05: CVE-2023-34096 is assigned.
  • 2023-06-06: Maintainer releases a patch with version 3.06-2, see Thruk's Changelog.
  • 2023-06-08: GitHub Security Advisory is released by maintainer.
  • 2023-06-08: Security advisory (author's blog post) is released by Galoget Latorre.
  • 2023-06-08: Exploit PoC is released by Galoget Latorre.
  • 2023-06-09: Exploit PoC is shared by Exploit Database (Exploit-DB).
  • 2023-06-09: Exploit PoC is shared by Packet Storm Security.

References:

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVE ID

CVE-2023-34096

Weaknesses

Credits