SHIRASAGI v1.19.1 से पहले HTTP अनुरोधों में URL को अनुचित तरीके से संसाधित करता है, जिसके परिणामस्वरूप एक पाथ ट्रैवर्सल भेद्यता होती है। यदि इस भेद्यता का फायदा उठाया जाता है, तो सर्वर पर मनमाने फ़ाइलें प्राप्त की जा सकती हैं w

The path traversal vulnerability in SHIRASAGI allows an attacker to bypass intended access controls and read files outside of the intended web root. By crafting malicious HTTP requests with carefully constructed paths, an attacker can potentially access sensitive configuration files, source code, or other data stored on the server. The impact can range from information disclosure to potential compromise of the entire system, depending on the files accessed and the privileges of the web server process. This vulnerability is similar in nature to other path traversal flaws that have been exploited to gain unauthorized access to systems.

Organizations deploying SHIRASAGI, particularly those with publicly accessible instances, are at risk. Systems with older, unpatched versions of SHIRASAGI are especially vulnerable. Shared hosting environments where multiple users share the same server instance could also be affected, as a compromise of one user's SHIRASAGI instance could potentially lead to access for other users.

1. 2024-10-15Disclosure

   disclosure

1. आरक्षित2024-10-04
2. प्रकाशित2024-10-15
3. संशोधित2024-10-23
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-46898 is to upgrade SHIRASAGI to version 1.19.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting access to the SHIRASAGI service through a Web Application Firewall (WAF) or proxy server. Configure the WAF to block requests containing suspicious path traversal patterns (e.g., “../”). Carefully review and restrict file permissions on the server to minimize the potential impact of a successful exploit. After upgrading, confirm the fix by attempting to access files outside the intended web root via HTTP requests; access should be denied.