1 line
6.4 KiB
JSON
1 line
6.4 KiB
JSON
{"schema_version":"1.9.0","id":"GHSA-75jv-vfxf-3865","published":"2025-07-25T14:15:48Z","modified":"2026-07-07T17:57:02.848397489Z","aliases":["CVE-2025-55013","PYSEC-2026-1194"],"summary":"Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code ","details":"**Path-Traversal -> Arbitrary File Write in Assemblyline Service Client**\n\n**IMPORTANT**: This vulnerability is valid if you decide to use the assemblyline-service-client outside of the normal practice to using Assemblyline in a production environment. In practice, this code should always be executed within a containerized environment such as [assemblyline-v4-service](https://github.com/CybercentreCanada/assemblyline-v4-service) which ensures filesystem-level permissions of what the running user is allowed to access. Furthermore, there is fewer chances for a MiTM compromise when deployed properly in a Docker or Kubernetes deployment where the platform will assign the correct network policies to secure connections between containers instead of relying on the user to set this up manually.\n\nSee https://github.com/CybercentreCanada/assemblyline/issues/382 for further discussion.\n\n---\n\n## 1. Summary \nThe Assemblyline 4 **service client** (`task_handler.py`) accepts a SHA-256 value returned by the service **server** and uses it directly as a local file name. \n> No validation / sanitisation is performed.\n\nA **malicious or compromised server** (or any MITM that can speak to client) can return a path-traversal payload such as \n`../../../etc/cron.d/evil` \nand force the client to write the downloaded bytes to an arbitrary location on disk.\n\n---\n\n## 2. Affected Versions \n| Item | Value |\n|---|---|\n| **Component** | `assemblyline-service-client` |\n| **Repository** | [CybercentreCanada/assemblyline-service-client](https://github.com/CybercentreCanada/assemblyline-service-client) |\n| **Affected** | **All releases up to master branch.** |\n\n\n---\n\n## 3. CVSS 3.1 Vector & Score \n```\nCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L\n```\n\n\n---\n\n## 4. Technical Details\n\n| Field | Content |\n|---|---|\n| **Location** | `assemblyline_service_client/task_handler.py`, inside `download_file()` |\n| **Vulnerable Line** | `file_path = os.path.join(self.tasking_dir, sha256)` |\n| **Root Cause** | The `sha256` string is taken directly from the service-server JSON response and used as a file name without any validation or sanitisation. |\n| **Exploit Flow** | 1. Attacker (service server) returns HTTP 200 for `GET /api/v1/file/../../../etc/cron.d/evil`.<br>2. Client writes the response body to `/etc/cron.d/evil`.<br>3. Achieves arbitrary file write (code execution if file is executable). |\n\n---\n\n## 5. Impact \n- **Integrity** – Overwrite any file writable by the service UID (often root). \n- **Availability** – Corrupt critical files or exhaust disk space. \n- **Code Execution** – Drop cron jobs, systemd units, or overwrite binaries.\n\n---\n\n## 6. Mitigation / Fix\n\n```python\nimport re\n\n_SHA256_RE = re.compile(r'^[0-9a-fA-F]{64}\\Z')\n\ndef download_file(self, sha256: str, sid: str) -> Optional[str]:\n if not _SHA256_RE.fullmatch(sha256):\n self.log.error(f\"[{sid}] Invalid SHA256: {sha256}\")\n self.status = STATUSES.ERROR_FOUND\n return None\n # or your preferred way to check if a string is a shasum.\n```\n---","affected":[{"package":{"name":"assemblyline-service-client","ecosystem":"PyPI","purl":"pkg:pypi/assemblyline-service-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0.stable11"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-75jv-vfxf-3865/GHSA-75jv-vfxf-3865.json"}},{"package":{"name":"assemblyline-service-client","ecosystem":"PyPI","purl":"pkg:pypi/assemblyline-service-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.1.dev0"},{"fixed":"4.6.1.dev138"}]}],"versions":["4.6.1.dev0","4.6.1.dev1","4.6.1.dev10","4.6.1.dev100","4.6.1.dev101","4.6.1.dev102","4.6.1.dev105","4.6.1.dev106","4.6.1.dev107","4.6.1.dev108","4.6.1.dev109","4.6.1.dev110","4.6.1.dev111","4.6.1.dev112","4.6.1.dev113","4.6.1.dev114","4.6.1.dev115","4.6.1.dev116","4.6.1.dev117","4.6.1.dev119","4.6.1.dev120","4.6.1.dev121","4.6.1.dev122","4.6.1.dev123","4.6.1.dev124","4.6.1.dev125","4.6.1.dev126","4.6.1.dev128","4.6.1.dev129","4.6.1.dev13","4.6.1.dev130","4.6.1.dev131","4.6.1.dev132","4.6.1.dev133","4.6.1.dev134","4.6.1.dev135","4.6.1.dev136","4.6.1.dev137","4.6.1.dev15","4.6.1.dev16","4.6.1.dev18","4.6.1.dev2","4.6.1.dev20","4.6.1.dev21","4.6.1.dev22","4.6.1.dev23","4.6.1.dev24","4.6.1.dev25","4.6.1.dev26","4.6.1.dev27","4.6.1.dev28","4.6.1.dev31","4.6.1.dev32","4.6.1.dev33","4.6.1.dev34","4.6.1.dev35","4.6.1.dev36","4.6.1.dev37","4.6.1.dev38","4.6.1.dev39","4.6.1.dev4","4.6.1.dev40","4.6.1.dev41","4.6.1.dev42","4.6.1.dev43","4.6.1.dev44","4.6.1.dev48","4.6.1.dev49","4.6.1.dev5","4.6.1.dev50","4.6.1.dev51","4.6.1.dev52","4.6.1.dev53","4.6.1.dev54","4.6.1.dev55","4.6.1.dev56","4.6.1.dev57","4.6.1.dev58","4.6.1.dev59","4.6.1.dev60","4.6.1.dev62","4.6.1.dev63","4.6.1.dev64","4.6.1.dev65","4.6.1.dev66","4.6.1.dev67","4.6.1.dev68","4.6.1.dev69","4.6.1.dev7","4.6.1.dev72","4.6.1.dev73","4.6.1.dev74","4.6.1.dev75","4.6.1.dev76","4.6.1.dev77","4.6.1.dev78","4.6.1.dev79","4.6.1.dev80","4.6.1.dev81","4.6.1.dev82","4.6.1.dev84","4.6.1.dev85","4.6.1.dev86","4.6.1.dev87","4.6.1.dev88","4.6.1.dev89","4.6.1.dev9","4.6.1.dev90","4.6.1.dev92","4.6.1.dev93","4.6.1.dev94","4.6.1.dev95","4.6.1.dev97","4.6.1.dev98","4.6.1.dev99"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-75jv-vfxf-3865/GHSA-75jv-vfxf-3865.json"}}],"references":[{"type":"WEB","url":"https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55013"},{"type":"WEB","url":"https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900"},{"type":"PACKAGE","url":"https://github.com/CybercentreCanada/assemblyline-service-client"}],"database_specific":{"cwe_ids":["CWE-23"],"github_reviewed":true,"github_reviewed_at":"2025-07-25T14:15:48Z","nvd_published_at":"2025-08-09T03:15:47Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"}]} |