Dumb Drop 存在任意文件覆盖和路径遍历漏洞，可获取 root shell

The Path Traversal vulnerability in DumbDrop allows an attacker to bypass intended file system restrictions. Given that the container runs as root by default, an attacker can overwrite any file on the system. This includes critical system binaries, configuration files, and scheduled tasks. Successful exploitation could lead to complete system takeover, allowing the attacker to execute arbitrary code, steal sensitive data, and establish persistent access. The lack of authentication requirements further exacerbates the risk, as even unauthenticated users with a PIN can potentially exploit this vulnerability. The potential for root access makes this a high-impact vulnerability with a significant blast radius.

Organizations deploying DumbDrop within Docker containers, particularly those running the application without authentication enabled or with permissive file upload permissions, are at significant risk. Shared hosting environments where multiple users have access to the DumbDrop service are also particularly vulnerable, as a compromised user account could be leveraged to exploit the vulnerability and gain access to the entire host system.

• docker: Inspect running containers for DumbDrop instances. Use docker ps to identify containers running the vulnerable application. Then, use docker exec -it <container_id> bash to gain shell access and check the version using dumbdrop --version. • linux / server: Monitor system logs (e.g., /var/log/syslog, /var/log/auth.log) for unusual file access patterns or attempts to write to sensitive system directories. Use auditd to monitor file access and create rules to detect suspicious activity. • generic web: Use curl to test for path traversal vulnerabilities by attempting to upload files with malicious filenames (e.g., ../../../../etc/passwd). Examine the response headers and file contents to confirm successful traversal.

1. 2025-01-31Disclosure

   disclosure

2. 2025-01-31Patch

   patch

1. 已保留2025-01-27
2. 发布日期2025-01-31
3. 修改日期2025-02-12
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2025-24891 is to upgrade DumbDrop to version 256.0.1 or later, which contains the fix for the Path Traversal vulnerability. If an immediate upgrade is not feasible due to compatibility issues or downtime constraints, consider implementing temporary workarounds. These may include restricting file upload permissions to trusted users only, implementing strict file name validation to prevent path traversal attempts, and configuring a Web Application Firewall (WAF) to block requests containing suspicious path traversal patterns (e.g., '../'). Monitor container logs for unusual file access patterns. After upgrading, verify the fix by attempting a path traversal attack and confirming that the attempt is blocked.