Path Traversal in Snipe-IT via CSV Import

Executive Summary

This vulnerability exists in the Snipe-IT IT asset/license management system prior to version 8.6.2. An authenticated user who has import and assets.update permissions can exploit a path traversal flaw by inserting a specially crafted path traversal string into an asset's image field during CSV import.

By doing this, the attacker can trigger the deletion of arbitrary files on the server that the application has access to, beyond just the intended asset images. This happens because the system does not properly restrict file paths, allowing deletion of files outside the designated directories.

The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and was fixed in version 8.6.2 by sanitizing file paths using the basename() function to ensure only filenames, not full paths, are processed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a significant impact on system integrity and availability. An attacker with the required permissions can delete arbitrary files on the server, potentially removing critical system or application files.

Such unauthorized file deletions can lead to data loss, service disruption, and compromise of the asset management system's reliability.

The CVSS score of 6.5 reflects a moderate severity with high impact on integrity and availability, meaning the system could be partially or fully disrupted by exploiting this vulnerability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an authenticated user exploiting the CSV import feature by injecting path traversal strings into asset image fields to delete arbitrary files. Detection would involve monitoring for unusual CSV import activities or suspicious file deletion events triggered by asset image updates.

Specifically, you can audit logs for CSV import actions performed by users with import and assets.update permissions and check for any file deletion operations that reference unexpected file paths.

Commands to help detect exploitation attempts might include:

• Review application logs for CSV import events and asset image deletions.
• Use file system monitoring tools (e.g., auditd on Linux) to track unlink or delete system calls on sensitive directories.
• Example auditd rule to monitor file deletions in the asset image directory: auditctl -w /path/to/snipe-it/assets/images -p wa -k snipeit_image_deletion
• Search for suspicious path traversal patterns in CSV import files or logs, such as '../' sequences.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Snipe-IT to version 8.6.2 or later, where this vulnerability has been fixed by properly sanitizing file paths to prevent path traversal.

Until the upgrade can be applied, restrict import and assets.update permissions to only trusted users to reduce the risk of exploitation.

Additionally, monitor and audit CSV import activities and file deletion operations to detect any suspicious behavior early.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated user to delete arbitrary files on the server, which can impact system integrity and availability.

Such unauthorized file deletion could lead to loss of critical data or disruption of services, potentially affecting compliance with standards like GDPR and HIPAA that require protection of data integrity and availability.

However, the provided information does not explicitly discuss the direct impact on compliance with these regulations.

Useful 0 Not Useful 0