Path Traversal in Jevon-Zhong Ai-doctor

Executive Summary

This vulnerability is a path traversal issue in Jevon-Zhong Ai-doctor 0.0.1. It affects the deleteImage function in ai-doctor-server/src/filemanagement/filemanagement.service.ts. The flaw allows manipulation of the imagePath argument to perform path traversal, enabling deletion of arbitrary local files outside the intended directory. The attack requires local access and the project has not responded to the reported issue.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file deletions or suspicious path traversal attempts in logs. Review the ai-doctor-server logs for requests to the image-deletion endpoint with unusual imagePath parameters containing sequences like ../. Use commands like grep to search for patterns in logs: grep -r "imagePath" /var/log/ or journalctl -u ai-doctor-server --no-pager | grep "imagePath"

Inspect the server's file system for missing or unexpectedly deleted files in the uploadImgs directory. Verify file permissions and ownership of critical system files to detect unauthorized access.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to delete critical system files or sensitive data that the application has permission to access. This could lead to denial of service, data loss, or unauthorized information disclosure. The impact depends on the server's file permissions and what files are accessible.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized file deletion or access to personal data. For HIPAA, it risks exposing protected health information if medical files are stored in accessible locations. Compliance impact depends on the specific data processed by the application.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the image-deletion endpoint if not essential. Implement input validation to reject paths containing traversal sequences (../), absolute paths, or path separators. Ensure the resolved path remains within the uploadImgs directory before file deletion.

Update the filemanagement.service.ts code to sanitize the imagePath parameter and verify file paths before deletion. Restrict server process permissions to limit file deletion scope.

Useful 0 Not Useful 0