Path Traversal in Anagnorisis up to 0.4.2

Executive Summary

This vulnerability is a path traversal issue in volotat Anagnorisis up to version 0.4.2. It affects functions like get_file_content, save_file_content, move_files, and start_streaming in the file page.html. An attacker can remotely exploit this to access unauthorized files by manipulating file paths.

Useful 0 Not Useful 0

Detection Guidance

Check for improper file path handling in Anagnorisis by reviewing Socket.IO handlers for text, image, video, metadata, and deletion events. Look for misuse of os.path.join() without canonicalization. Test by attempting path traversal with crafted inputs to see if files outside the media directory are accessible or modifiable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could read sensitive files, modify or delete files, or execute unauthorized actions on the server. This may lead to data breaches, system compromise, or service disruption depending on the affected system's role.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR (data protection) and HIPAA (health information privacy). Non-compliance may result in legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update volotat Anagnorisis to the latest version beyond 0.4.2 to address the path traversal vulnerability in the affected functions. If an update is unavailable, disable or restrict access to the vulnerable functions (get_file_content, save_file_content, move_files, start_streaming) in page.html. Monitor network traffic for unusual file access patterns or unauthorized file operations.

Useful 0 Not Useful 0