Path Traversal in Koodo Reader via OPDS Cover Handler

Executive Summary

Koodo Reader through 2.4.6 has a path traversal flaw in its self-hosted HTTP server's OPDS handlers. Authenticated attackers can exploit this by uploading a malicious books.db file with a cover value containing ../ sequences. This allows them to read files outside the intended upload directory by requesting /opds/cover/{key}.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file access attempts in server logs, particularly for requests to /opds/cover/{key} with path traversal sequences like ../ in parameters. Inspect uploaded books.db files for malicious cover values containing directory traversal sequences.

Useful 0 Not Useful 0

Impact Analysis

If you use Koodo Reader 2.4.6 or earlier, an attacker with access could read sensitive files on the server where the application runs. This includes configuration files, user data, or other restricted files, potentially leading to data leaks or further attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance breaches, legal penalties, or reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update Koodo Reader to the latest version beyond 2.4.6. Restrict file system permissions for the server process to prevent access to sensitive directories. Monitor and block requests containing ../ sequences in OPDS handlers.

Useful 0 Not Useful 0