Vulnerability Details : CVE-2022-24900
Potential exploit
Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The `os.path.join` call is unsafe for use with untrusted input. When the `os.path.join` call encounters an absolute path, it ignores all the parameters it has encountered till that point and starts working with the new absolute path. Since the "malicious" parameter represents an absolute path, the result of `os.path.join` ignores the static directory completely. Hence, untrusted input is passed via the `os.path.join` call to `flask.send_file` can lead to path traversal attacks. A patch with a fix is available on the `master` branch of the GitHub repository. This can also be fixed by preventing flow of untrusted data to the vulnerable `send_file` function. In case the application logic necessiates this behaviour, one can either use the `flask.safe_join` to join untrusted paths or replace `flask.send_file` calls with `flask.send_from_directory` calls.
Vulnerability category: Directory traversalFile inclusion
Products affected by CVE-2022-24900
- cpe:2.3:a:piano_led_visualizer_project:piano_led_visualizer:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-24900
82.86%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-24900
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
|
8.6
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
3.9
|
4.0
|
NIST | |
|
9.9
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L |
3.9
|
5.3
|
GitHub, Inc. |
CWE ids for CVE-2022-24900
-
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Assigned by: security-advisories@github.com (Secondary)
-
The product allows user input to control or influence paths or file names that are used in filesystem operations.Assigned by: security-advisories@github.com (Secondary)
-
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.Assigned by: nvd@nist.gov (Primary)
-
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-24900
-
https://github.com/onlaj/Piano-LED-Visualizer/issues/350
Security Vulnerability Found · Issue #350 · onlaj/Piano-LED-Visualizer · GitHubExploit;Issue Tracking;Patch;Third Party Advisory
-
https://github.com/onlaj/Piano-LED-Visualizer/blob/6a732caa812c83a807c711f3d091af99209cae7b/webinterface/views_api.py#L970
Piano-LED-Visualizer/views_api.py at 6a732caa812c83a807c711f3d091af99209cae7b · onlaj/Piano-LED-Visualizer · GitHubExploit;Third Party Advisory
-
https://github.com/onlaj/Piano-LED-Visualizer/pull/351
Fix Path Traversal Vulnerability by porcupineyhairs · Pull Request #351 · onlaj/Piano-LED-Visualizer · GitHubExploit;Issue Tracking;Patch;Third Party Advisory
-
https://github.com/onlaj/Piano-LED-Visualizer/security/advisories/GHSA-g78x-q3x8-r6m4
Absolute Path Traversal due to incorrect use of `send_file` call · Advisory · onlaj/Piano-LED-Visualizer · GitHubExploit;Patch;Third Party Advisory
-
https://github.com/onlaj/Piano-LED-Visualizer/commit/3f10602323cd8184e1c69a76b815655597bf0ee5
Merge pull request #351 from porcupineyhairs/FixPathInjection · onlaj/Piano-LED-Visualizer@3f10602 · GitHubPatch;Third Party Advisory
Jump to