Executive Summary

The vulnerability in zrok's WebDAV drive backend (prior to version 2.0.2) arises because it restricts path traversal through lexical normalization but does not prevent following symbolic links (symlinks). This means if a symlink inside the shared DriveRoot points to a location outside that root, remote WebDAV users can read files outside the intended directory.

Furthermore, on shares without operating system-level permission restrictions, attackers can write or overwrite files anywhere on the host filesystem accessible to the zrok process. Exploitation requires a pre-existing symlink inside the DriveRoot that points outside, but once that condition is met, no user interaction or authentication is needed.

This vulnerability is classified under CWE-22 (Path Traversal) and CWE-61 (UNIX Symbolic Link Following), highlighting the failure to properly restrict file access and handle symlinks securely.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a significant impact on the confidentiality and integrity of your system's files. An attacker exploiting this issue can read sensitive files outside the intended shared directory.

If the shared drive does not have OS-level permission restrictions, the attacker can also write or overwrite files anywhere on the host filesystem accessible to the zrok process, potentially leading to data corruption, unauthorized data modification, or further system compromise.

The attack is network-based and requires no authentication by default, increasing the risk if public shares are exposed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves symlink traversal in the zrok WebDAV drive backend, where symbolic links inside the shared DriveRoot point to locations outside that root. Detection involves identifying such symlinks within the DriveRoot directory that resolve outside the intended shared directory.

To detect potential exploitation or presence of this vulnerability on your system, you can scan the DriveRoot directory for symbolic links that point outside the DriveRoot path. For example, using Unix/Linux commands:

• Find all symbolic links inside the DriveRoot directory: `find /path/to/DriveRoot -type l`
• For each symlink found, check where it points to with: `readlink -f <symlink>` and verify if the resolved path is outside the DriveRoot.
• Monitor network traffic for WebDAV requests accessing files outside the expected directory, which may indicate exploitation attempts.

Note that exploitation requires a pre-existing symlink inside DriveRoot pointing outside, so detection focuses on identifying such symlinks and monitoring WebDAV access patterns.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the zrok software to version 2.0.2 or later, where this vulnerability has been patched.

The fix in version 2.0.2 introduces a path resolution function that prevents symlink traversal outside the configured shared directory, effectively blocking unauthorized file access.

Additionally, as an immediate measure before upgrading, you should:

• Remove or restrict any symbolic links inside the DriveRoot directory that point outside the shared directory.
• Apply OS-level permission restrictions on the shared directories to limit write access and reduce the risk of unauthorized file modifications.
• Restrict or monitor WebDAV access, especially on public shares that do not require authentication, to prevent unauthorized exploitation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in zrok's WebDAV drive backend allows unauthorized remote users to read and potentially write or overwrite files outside the intended shared directory on the host filesystem. This unauthorized access can lead to exposure or modification of sensitive data.

Such unauthorized access and potential data breaches could negatively impact compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls over the confidentiality and integrity of sensitive personal and health information.

Because the vulnerability enables attackers to bypass intended access controls and access broader parts of the filesystem, it increases the risk of data leakage or tampering, which are critical concerns under these regulations.

Useful 0 Not Useful 0