Executive Summary

This vulnerability exists in Dosage versions 3.1 and below, where the software downloads comic images and constructs target file names using information from the remote comic. Although the base file name is sanitized to remove directory-traversing characters, the file extension is taken directly from the HTTP Content-Type header. This flaw allows a remote attacker or a Man-in-the-Middle (if the comic is served over HTTP) to manipulate the file extension and potentially write arbitrary files outside the intended target directory, leading to unauthorized file creation or overwriting.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to an attacker writing arbitrary files outside the intended directory on the victim's system. This can result in unauthorized file creation or modification, potentially leading to system compromise, data corruption, or denial of service. Because the vulnerability allows for arbitrary file writes, it can severely impact the confidentiality, integrity, and availability of the affected system.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Dosage to version 3.2 or later, as this version fixes the vulnerability. Avoid using versions 3.1 and below to prevent exploitation.

Useful 0 Not Useful 0