Path Traversal in Appium Storage Plugin

Executive Summary

This vulnerability exists in the Appium storage plugin prior to version 1.1.6. The plugin exposes a POST /storage/delete endpoint that takes a user-supplied name value and directly uses it in a file path operation without sanitizing it. Specifically, it passes the name into path.join(storageRoot, name) and then calls fs.rimraf() to delete files or directories. Because the input is not sanitized, an unauthenticated remote attacker can use directory traversal sequences (../) to escape the intended storage root directory and recursively delete arbitrary writable files or directories on the system.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated remote attacker to delete arbitrary files or directories on the affected system. The attacker can escape the intended storage directory and perform recursive deletions, potentially leading to loss of important data or disruption of services. Since the attacker does not need any privileges or user interaction, the impact is significant and can cause denial of service or data loss.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Appium to version 1.1.6 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated remote attackers to delete arbitrary writable files or directories on the host filesystem by exploiting path traversal in the Appium storage plugin. This can lead to data loss and denial of service.

Such unauthorized deletion of files, including potentially sensitive data or system configuration files, could impact compliance with standards like GDPR or HIPAA, which require protection of data integrity and availability.

Because the vulnerability enables high integrity impact without authentication, it poses a significant risk to maintaining secure and reliable data handling practices mandated by these regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an unauthenticated remote POST request to the /storage/delete endpoint of the Appium storage plugin, where the 'name' parameter is not properly sanitized, allowing path traversal attacks.

To detect if your system is vulnerable, you can check the version of the @appium/storage-plugin installed. Versions 1.1.5 and earlier are vulnerable, while version 1.1.6 and later include the fix.

You can also monitor network traffic or logs for suspicious POST requests to /storage/delete containing path traversal sequences like "../" in the 'name' parameter.

Example commands to check the installed version and test for vulnerability include:

• Check the installed version of the storage plugin (run in the environment where Appium is installed): npm list @appium/storage-plugin
• If the version is 1.1.5 or earlier, the system is vulnerable.
• Test for the vulnerability by sending a crafted POST request to the Appium server (replace <appium_host> and <appium_port>): curl -X POST http://<appium_host>:<appium_port>/storage/delete -d '{"name":"../somefile"}' -H 'Content-Type: application/json'
• If the request succeeds in deleting files outside the storage root or returns a success response without sanitization errors, the system is vulnerable.

Additionally, review Appium server logs for any errors or suspicious delete requests involving path traversal patterns.

Useful 0 Not Useful 0