CVE-2022-51024: Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to retrieve configuration files outside the temp directory. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kavitato a version that resolves this vulnerability.Fixed in 0.5.4.1
Event History
Frequently Asked Questions
Which deployments are affected?
Kavita versions from 0.5.2 up to, but not including, 0.5.4.1 are affected. Instances exposed to network clients should be prioritized because the vulnerable endpoint can be reached with GET requests.
Does an attacker need an account or user interaction to exploit this?
No. The vulnerability can be exploited by an unauthenticated attacker, and no user interaction is required.
What evidence should defenders look for in request logs?
Review requests to /api/image/cover-upload for filename parameters containing ../ sequences, particularly attempts to request files such as ../appsettings.json. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.