Chall-Manager é vulnerável a Path Traversal ao extrair/decodificar um arquivo zip em github.com/ctfer-io/chall-manager

The Path Traversal vulnerability in Chall-Manager allows an attacker to bypass intended file access restrictions. By providing a specially crafted zip archive, an attacker can manipulate the extraction process to access files outside of the intended directory. This could lead to the exposure of sensitive configuration files, source code, or even system files, depending on the server's file system structure and permissions. The potential impact is significant, ranging from information disclosure to complete system compromise if the attacker gains access to credentials or other critical data.

Organizations and individuals deploying Chall-Manager in environments where zip archives are processed without proper validation are at risk. This includes those using Chall-Manager for CTF challenge management or similar applications. Shared hosting environments where Chall-Manager is installed alongside other applications are particularly vulnerable, as a compromise could potentially affect other tenants.

• go / binary: Use strings to search for file paths within the Chall-Manager binary. Look for patterns like ../ or absolute paths to sensitive directories.

strings /path/to/chall-manager | grep '../'

• go / supply-chain: Examine dependencies for known vulnerabilities using go mod tidy and go vet. • generic web: Monitor web server access logs for requests containing suspicious file paths or attempts to access files outside of the expected directory structure. Look for requests with ../ in the URL.

grep '../' /var/log/apache2/access.log

1. 2025-07-28Disclosure

   disclosure

1. Reservado2025-07-07
2. Publicada2025-07-28
3. Modificada2026-03-03
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2025-53632 is to immediately upgrade Chall-Manager to version 0.1.4 or later. If upgrading is not feasible due to compatibility issues or downtime concerns, consider implementing strict input validation on any zip archives processed by Chall-Manager. This should include verifying the archive's contents and ensuring that file paths do not contain traversal sequences (e.g., '..'). Additionally, restrict the user account running Chall-Manager to the minimum necessary privileges to limit the potential damage from a successful exploit. After upgrading, confirm the fix by attempting to extract a zip archive with a path traversal payload and verifying that access is denied.