CVE-2022-25377: Path Traversal
The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APPSTORAGECERTIFICATES/.well-known/acme-challenge must exist on disk. (This pathname is automatically created if the user chooses to install Let's Encrypt certificates via Appwrite.)
Other sources
The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APPSTORAGECERTIFICATES/.well-known/acme-challenge must exist on disk. (This pathname is automatically created if the user chooses to install Let's Encrypt certificates via Appwrite.)
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25377?
CVE-2022-25377 is considered a high severity vulnerability due to the potential for remote file reading via directory traversal.
How do I fix CVE-2022-25377?
To fix CVE-2022-25377, upgrade your Appwrite installation to version 0.12.2 or later.
What versions of Appwrite are affected by CVE-2022-25377?
Appwrite versions from 0.5.0 to less than 0.12.2 are affected by CVE-2022-25377.
What causes the vulnerability in CVE-2022-25377?
The vulnerability in CVE-2022-25377 is caused by improper handling of the ACME-challenge endpoint that allows for directory traversal.
Can CVE-2022-25377 allow unauthorized access to sensitive files?
Yes, CVE-2022-25377 can potentially allow unauthorized attackers to read arbitrary local files on the server.