Path Traversal in Marker through 2.0.0

Executive Summary

This is a path traversal vulnerability in the marker library version 2.0.0 or earlier. The issue occurs in the FastAPI /marker/upload handler where the file.filename parameter is not properly sanitized. Unauthenticated attackers can exploit this by supplying filenames with directory traversal sequences like '../' to write arbitrary files to any location on the system or delete existing files.

Useful 0 Not Useful 0

Detection Guidance

Check if your system runs marker through 2.0.0 or earlier by inspecting installed versions or server logs. Monitor for unexpected file writes or deletions in system directories. Review FastAPI /marker/upload endpoint access logs for unusual filenames containing '../' or absolute paths.

Useful 0 Not Useful 0

Impact Analysis

An attacker could overwrite critical system files, delete important data, or plant malicious files to achieve code execution. Since the endpoint requires no authentication, any network client can exploit this. This could lead to full system compromise, data loss, or unauthorized access depending on the files targeted.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or deletion, violating GDPR's integrity and confidentiality principles and HIPAA's security rule requirements for protecting sensitive health information. Non-compliance risks include fines, legal action, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade marker to a patched version beyond 2.0.0. Implement filename sanitization by extracting only the basename and validating paths stay within the upload directory. Add authentication to the /marker/upload endpoint. Disable the endpoint if not needed. Monitor for suspicious file operations.

Useful 0 Not Useful 0