Path Traversal in Gerapy Project Management

Executive Summary

This vulnerability is a path traversal issue in Gerapy up to version 0.9.13. It affects the project_create function in gerapy/server/core/views.py where manipulating the project_name argument allows an attacker to traverse outside intended directories. The exploit is possible remotely and has been publicly disclosed.

Useful 0 Not Useful 0

Detection Guidance

Check Gerapy logs for unauthorized project upload attempts or path traversal patterns in the project_name parameter. Inspect uploaded ZIP files for entries containing ../ or similar path traversal sequences. Verify if the project_upload endpoint is accessible without authentication by testing unauthenticated POST requests to /api/project/upload.

Useful 0 Not Useful 0

Impact Analysis

An attacker could upload malicious files to unintended locations on the server, potentially overwriting existing files or injecting malicious code. This could lead to unauthorized access, data theft, or remote code execution if the server processes the malicious files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Compliance may be compromised if sensitive data is exposed or altered due to the path traversal.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the patch from commit 6e481078cfba6388a67ca2d9792288405019ba3e to enforce authentication and validate ZIP file paths. Ensure the @permission_classes([IsAuthenticated]) decorator is enabled for the project_upload endpoint. Monitor for unauthorized upload attempts and restrict access to the /api/project/upload endpoint.

Useful 0 Not Useful 0