Path Traversal in Cloudreve File Management System

Executive Summary

Cloudreve before version 4.17.0 has a vulnerability in the WOPI PUT_RELATIVE handler. It incorrectly processes the X-WOPI-SuggestedTarget header as a path instead of a filename, allowing directory traversal sequences like slash and dot-dot segments. This enables attackers to escape the intended file directory and create or overwrite files elsewhere within the same owner account.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unexpected file creation or modification in user accounts, particularly files outside intended directories. Check logs for WOPI PUT_RELATIVE requests with X-WOPI-SuggestedTarget headers containing path traversal sequences like ../ or /.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized file creation or modification outside the intended directory. Attackers with access to the WOPI interface might manipulate files, potentially leading to data corruption, unauthorized access, or further system compromise within the same user account.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized file creation or overwriting within a user's account. If exploited, it may allow access to or modification of sensitive data outside intended directories, violating data integrity and access control requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Cloudreve to version 4.17.0 or later to address the vulnerability. Ensure no unauthorized files have been created or modified outside the intended directory.

Useful 0 Not Useful 0