Executive Summary

This vulnerability in MindsDB prior to version 25.11.1 is a path traversal flaw in the file upload API. When a user uploads a file using a JSON request, the filename is not properly sanitized, allowing an attacker to specify arbitrary file paths. This lets an unauthenticated attacker read any file on the server filesystem accessible to MindsDB and move it into MindsDB's storage. The issue arises because only multipart and URL-sourced uploads have filename sanitization, while JSON uploads do not, enabling attackers to escape restricted directories and access sensitive files. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts as it allows any unauthenticated user with access to the MindsDB REST API to read and exfiltrate arbitrary files from the server filesystem. This can lead to exposure of sensitive data such as credentials, configuration secrets, private keys, and other confidential information. Additionally, the exploit can remove the original files from their source locations, potentially causing data loss or service disruption. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusual PUT requests to the MindsDB file upload API that contain JSON payloads with file paths including relative path traversal sequences (e.g., '../') or absolute paths (e.g., '/etc/passwd'). A proof-of-concept involves sending a PUT request with a JSON body specifying a file path that escapes the intended directory. Network traffic inspection tools or web application firewalls can be configured to alert on such suspicious requests. For example, using curl to test the vulnerability: curl -X PUT -H "Content-Type: application/json" -d '{"file": "../../etc/passwd"}' http://<mindsdb-server>/api/file-upload. Additionally, reviewing server logs for unexpected file movements or missing files may indicate exploitation attempts. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade MindsDB to version 25.11.1 or later, where the vulnerability is fixed by proper sanitization of file paths in JSON uploads. Until the upgrade can be applied, restrict access to the MindsDB REST API to trusted users only, implement network-level controls to block unauthorized PUT requests to the file upload endpoint, and monitor logs for suspicious activity. Applying web application firewall rules to detect and block path traversal patterns in JSON payloads can also help mitigate exploitation. [1]

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to read and exfiltrate arbitrary files from the server filesystem, potentially exposing sensitive data such as credentials, configuration secrets, and private keys. Such exposure of sensitive data can lead to non-compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access. [1]

Useful 0 Not Useful 0