CVE-2024-4982: Pagure: path traversal in view_issue_raw_file()
A directory traversal vulnerability was discovered in Pagure server. If a malicious user submits a specially cratfted git repository they could discover secrets on the server.
Other sources
Description of problem: In issues.py, viewissuerawfile() services issues attachments from pagureconfig["ATTACHMENTSFOLDER"]. The requested filename comes directly from the URL and is concatenated with the attachments folder and the repository name.
@UINS.route("/<repo>/issue/raw/<path:filename>") @UINS.route("/<namespace>/<repo>/issue/raw/<path:filename>") @UINS.route("/fork/<username>/<repo>/issue/raw/<path:filename>") @UINS.route("/fork/<username>/<namespace>/<repo>/issue/raw/<path:filename>") @hasissuetracker def viewissuerawfile(repo, filename=None, username=None, namespace=None): # [...] attachdir = os.path.join( pagureconfig["ATTACHMENTSFOLDER"], repo.fullname ) attachpath = os.path.join(attachdir, filename) if not os.path.exists(attachpath): # [...] # At this moment, attachpath exists and points to the file with open(attachpath, "rb") as f: data = f.read() # [...] return (data, 200, pagure.lib.mimetype.gettypeheaders(filename, data))
The "path" routing converter accepts all characters, including slashes and thus also directory traversal sequences.
Version-Release number of selected component (if applicable): Introduced with commit 96c928b in release 3.0, and verified on latest commit as of today (fe91f76).
How reproducible: This bug can be reproduced on the latest development version of Pagure; see steps below.
It is important to note that reverse-proxies in front of Pagure can thwart exploitation attemps depending on their configuration, as they often try to normalize the URL. This is not a security feature and it shouldn't be relied upon.
I could demonstrate it locally but not on stg.pagure.io after succint tests.
Steps to Reproduce: 1. Create a new repository; 2. Go to "Settings", "Project Options" and make sure that "Issue tracker" is ticked; 3. Run the command curl --path-as-is 'http://pagure.local:5000/your-repository/issue/raw/../../../../../../../etc/passwd'.
Actual results: On my test instance, the content of /etc/passwd is shown.
Expected results: Only files under the intended attachments folder should be served.
Additional info: Flask offers flask.sendfromdirectory() (https://flask.palletsprojects.com/en/3.0.x/api/#flask.sendfromdirectory) for such cases.
https://bugzilla.redhat.com/showbug.cgi?id=2279411
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4982?
CVE-2024-4982 is considered a high severity directory traversal vulnerability in Pagure Server.
How do I fix CVE-2024-4982?
To fix CVE-2024-4982, update Pagure Server to a version that addresses this vulnerability.
What impact does CVE-2024-4982 have on Pagure Server?
CVE-2024-4982 allows a malicious user to potentially access sensitive information stored on the server.
Which versions of Pagure Server are affected by CVE-2024-4982?
Pagure Server version 3.0 and above are affected by CVE-2024-4982.
How does CVE-2024-4982 allow exploitation?
CVE-2024-4982 allows exploitation through specially crafted git repositories that can manipulate file paths.