WhoDB には github.com/clidey/whodb/core 内の Sqlite3 データベースを開く際のパストラバーサル脆弱性があります。

The core of this vulnerability lies in the improper handling of file paths within the WhoDB core component. An attacker can craft malicious requests that exploit this flaw to traverse the file system and directly access the SQLite3 database file. This database likely contains sensitive information such as user credentials, configuration details, or other application-specific data. Successful exploitation could lead to unauthorized data disclosure, potentially compromising the entire system. The impact is particularly severe given the CRITICAL CVSS score, indicating a high likelihood of exploitation and significant potential damage.

Organizations utilizing WhoDB in their infrastructure, particularly those deploying it in environments with limited access controls or without robust WAF protection, are at significant risk. Shared hosting environments where multiple users share the same WhoDB instance are also particularly vulnerable, as a compromise of one user's instance could potentially expose data from other users.

• go / server: Examine application logs for requests containing path traversal sequences (e.g., ../). Use go tool pprof to analyze function call graphs and identify potential path traversal vulnerabilities in the WhoDB core code. • generic web: Use curl or wget to probe for file access outside of the intended directory. For example: curl 'http://your-whodb-server/../../../../etc/passwd' • linux / server: Monitor process execution for WhoDB core processes accessing unexpected files. Use lsof to identify open files and directories. • database (sqlite): If the database is accessible, query the SQLite database schema to identify sensitive tables and columns.

1. 2025-02-07Disclosure

   disclosure

1. 予約済み2025-01-23
2. 公開日2025-02-07
3. 更新日2026-03-03
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2025-24786 is to immediately upgrade WhoDB core to version 0.0.0-20250127172032-547336ac73c8 or later. If upgrading is not immediately feasible, consider implementing a temporary workaround by restricting access to the WhoDB core component through a Web Application Firewall (WAF) or proxy. Configure the WAF to block requests containing path traversal sequences (e.g., ../). Monitor access logs for suspicious activity, particularly attempts to access files outside of the intended directory. After upgrading, confirm the fix by attempting a path traversal attack and verifying that access is denied.