Path Traversal in FileRise Resumable.js Allows Arbitrary File Write

Mitigation Strategies

To mitigate this vulnerability, you should upgrade FileRise to version 3.10.0 or later, where the issue has been patched.

Additionally, restrict upload permissions to only trusted authenticated users to reduce the risk of exploitation.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can have serious impacts including unauthorized file writes to arbitrary directories, which can lead to data corruption or unauthorized data placement. It also allows deletion of arbitrary directories, potentially causing data loss. Additionally, it enables an attacker to probe the existence of files or directories, which can be used for further attacks or information gathering.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in FileRise, a self-hosted web file manager and WebDAV server, in versions from 1.0.1 up to but not including 3.10.0. It involves the resumableIdentifier parameter used in the Resumable.js chunked upload handler. The parameter is concatenated directly into filesystem paths without any sanitization, which means an authenticated user with upload permission can manipulate this parameter to write files to arbitrary directories on the server, delete arbitrary directories during cleanup, and probe for the existence of files or directories.

Useful 0 Not Useful 0