Skip to content

Path traversal via screen controller (`GHSL-2024-127`)

Moderate
ryanmelt published GHSA-8jxr-mccc-mwg8 Oct 2, 2024

Package

No package listed

Affected versions

< 5.19.0

Patched versions

5.19.0

Description

Summary

A path traversal vulnerability inside of LocalMode's open_local_file method allows an authenticated user with adequate permissions to download any .txt via the ScreensController#show on the web server COSMOS is running on (depending on the file permissions).

Note: This CVE affects all OpenC3 COSMOS Editions

Impact

This issue may lead to Information Disclosure.

Severity

Moderate

CVE ID

CVE-2024-46977

Weaknesses

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Learn more on MITRE.

Credits