Ferret hat eine Path Traversal in IO::FS::WRITE, die es ermöglicht, beliebige Dateien zu schreiben, wenn bösartige Websites gecrawlt werden

The core of the vulnerability lies in Ferret's IO::FS::WRITE function. When scraping websites, Ferret typically uses filenames returned by the website to construct output paths. An attacker can craft a malicious website that returns filenames containing ../ sequences. Ferret, without proper sanitization, will then use these manipulated filenames to write files to arbitrary locations on the system. This allows an attacker to overwrite critical system files, such as cron jobs, SSH authorized keys, or shell profiles, leading to complete system compromise. The potential for remote code execution is significant, as an attacker can inject malicious code into these files, which will then be executed by the system.

Developers and organizations using Ferret for web scraping and data extraction are at risk. Specifically, those relying on untrusted external data sources without proper input validation are particularly vulnerable. Shared hosting environments where multiple users may be running Ferret scripts could also be affected, as an attacker could potentially compromise the entire host.

• javascript / node.js:

// Check for Ferret version
const ferretVersion = require('ferret').version;
console.log(`Ferret version: ${ferretVersion}`);
// If version < 2.0.0-alpha.4, the system is vulnerable.

• generic web:

# Check for suspicious file writes in logs
grep -r "../" /var/log/ferret/*

1. 2026-04-06Disclosure

   disclosure

1. Reserviert2026-03-30
2. Veröffentlicht2026-04-06
3. Geändert2026-04-07
4. EPSS aktualisiert2026-04-14

The primary mitigation is to upgrade Ferret to version 2.0.0-alpha.4 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing input validation on the filenames received from the scraped website. Specifically, sanitize any filenames containing ../ sequences before using them to construct output paths. A Web Application Firewall (WAF) could also be configured to block requests containing suspicious filenames. While a direct detection signature is difficult to create, monitoring file system activity for unexpected writes to sensitive locations (e.g., /etc/cron.d/, ~/.ssh/authorized_keys) can provide an early warning sign.