CVE-2024-58404: Zipline 3.4.5 before 3.7.10 Path Traversal via user export endpoint
Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via the name query parameter. Authenticated attackers can bypass the user id check and use directory traversal sequences to read arbitrary files on the server host.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.7.10
Event History
Frequently Asked Questions
Which deployments are affected?
Zipline versions from 3.4.5 up to, but not including, 3.7.10 are affected. The vulnerable functionality is the user data export endpoint.
What does an attacker need to exploit this issue?
An attacker needs authentication with low privileges. They can supply directory traversal sequences through the name query parameter to bypass the user ID check.
What is the impact of successful exploitation?
A successful attacker can read arbitrary files from the server host. The provided vector indicates no user interaction is required and that the impact is limited to confidentiality.