Path Traversal in Appium Storage Plugin

Executive Summary

This vulnerability exists in the Appium storage plugin prior to version 1.1.6. The plugin exposes a POST /storage/delete endpoint that takes a user-supplied name value and directly uses it in a file path operation without sanitizing it. Specifically, it passes the name into path.join(storageRoot, name) and then calls fs.rimraf() to delete files or directories. Because the input is not sanitized, an unauthenticated remote attacker can use directory traversal sequences (../) to escape the intended storage root directory and recursively delete arbitrary writable files or directories on the system.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated remote attacker to delete arbitrary files or directories on the affected system. The attacker can escape the intended storage directory and perform recursive deletions, potentially leading to loss of important data or disruption of services. Since the attacker does not need any privileges or user interaction, the impact is significant and can cause denial of service or data loss.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Appium to version 1.1.6 or later, where the issue has been fixed.

Useful 0 Not Useful 0