PenDoc anfällig für Arbitrary File Read beim Aktualisieren und Herunterladen von Vorlagen unter Verwendung von Path Traversal

Successful exploitation of this Path Traversal vulnerability allows an attacker to bypass intended access controls and read sensitive files from the server's file system. This could include configuration files, source code, database credentials, or other confidential data. The attacker's ability to read arbitrary files depends on the permissions of the user account running the PwnDoc application. While the vulnerability requires authentication, a compromised account could grant significant access to the underlying system. The potential blast radius extends to any data accessible by the PwnDoc process, potentially exposing sensitive information about the target environment and penetration testing activities.

Organizations using PwnDoc for penetration testing and report generation are at risk, particularly those with less stringent access controls. Shared hosting environments where multiple users have access to PwnDoc templates are especially vulnerable, as a compromised user account could be used to exploit this vulnerability.

• python: Monitor PwnDoc logs for unusual file access attempts, especially those involving ../ sequences. Use Python's os.path.abspath() function to sanitize file paths before processing them.

import os
filepath = os.path.abspath(user_supplied_path)
if not filepath.startswith(base_directory):
    # Reject the path
    print("Invalid path")

• generic web: Examine web server access logs for requests containing path traversal patterns (e.g., ../../). • generic web: Check for unusual file extensions being uploaded or accessed through PwnDoc's interface.

1. 2024-12-10Disclosure

   disclosure

1. Reserviert2024-12-09
2. Veröffentlicht2024-12-10
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-55602 is to upgrade PwnDoc to version 1d4219c596f4f518798492e48386a20c6e9a2fe6, which contains the fix. If an immediate upgrade is not feasible, consider restricting access to template update and download functionality to trusted users only. Implement strict input validation on file extension properties to prevent the injection of path traversal sequences. Review and harden the permissions of the user account running the PwnDoc application to limit the potential impact of a successful exploit. After upgrading, confirm the fix by attempting to upload a template with a path traversal sequence in the file extension and verifying that the attempt is rejected.