CVE-2024-25123: Insufficient Information (NVD-CWE-noinfo)
value: MSS (Mission Support System) is an open source package designed for planning atmospheric research flights. In file: `index.py`, there is a method that is vulnerable to path manipulation attack. By modifying file paths, an attacker can acquire sensitive information from different resources. The `filename` variable is joined with other variables to form a file path in `_file`. However, `filename` is a route parameter that can capture path type values i.e. values including slashes (\). So it is possible for an attacker to manipulate the file being read by assigning a value containing ../ to `filename` and so the attacker may be able to gain access to other files on the host filesystem. This issue has been addressed in MSS version 8.3.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-15T22:15Z
Repository: https://github.com/Open-MSS/MSS
Language: Python
Files changed: mslib/index.py, mslib/mscolab/server.py
Commit date: 2024-02-08 16:00:40 +0100
Commit message: Merge pull request from GHSA-pf2h-qjcr-qvq2


Diff: diff --git a/mslib/index.py b/mslib/index.py
index 2c63ad3e..71734a06 100644
--- a/mslib/index.py
+++ b/mslib/index.py
@@ -27,10 +27,11 @@
 
 import sys
 import os
 import codecs
 import mslib
+import werkzeug
 
 from flask import render_template
 from flask import send_from_directory, send_file, url_for
 from flask import abort
 from flask import request
@@ -159,15 +160,19 @@ def create_app(name=""):
         return render_template("/content.html", act="plots", content=content)
 
     @APP.route("/mss/code/<path:filename>")
     def code(filename):
         download = request.args.get("download", False)
-        _file = os.path.join(STATIC_LOCATION, 'code', filename)
+        _file = werkzeug.security.safe_join(STATIC_LOCATION, "code", filename)
+        if _file is None:
+            abort(404)
         content = get_content(_file)
         if not download:
             return render_template("/content.html", act="code", content=content)
         else:
+            if not os.path.isfile(_file):
+                abort(404)
             with open(_file) as f:
                 text = f.read()
             return Response("".join([s.replace("\t", "", 1) for s in text.split("```python")[-1]
                                     .splitlines(keepends=True)][1:-2]),
                             mimetype="text/plain",
diff --git a/mslib/mscolab/server.py b/mslib/mscolab/server.py
index 8bcd4763..b335398e 100644
--- a/mslib/mscolab/server.py
+++ b/mslib/mscolab/server.py
@@ -32,10 +32,12 @@ import datetime
 import secrets
 import fs
 import os
 import socketio
 import sqlalchemy.exc
+import werkzeug
+
 from itsdangerous import URLSafeTimedSerializer, BadSignature
 from flask import g, jsonify, request, render_template, flash
 from flask import send_from_directory, abort, url_for
 from flask_mail import Mail, Message
 from flask_cors import CORS
@@ -376,11 +378,11 @@ def uploads(name=None, filename=None):
     base_path = mscolab_settings.UPLOAD_FOLDER
     if name is None:
         abort(404)
     if filename is None:
         abort(404)
-    return send_from_directory(fs.path.join(base_path, name), filename)
+    return send_from_directory(base_path, werkzeug.security.safe_join("", name, filename))
 
 
 # 413: Payload Too Large
 @APP.errorhandler(413)
 def error413(error):

Vulnerable code:         _file = os.path.join(STATIC_LOCATION, 'code', filename)
    return send_from_directory(fs.path.join(base_path, name), filename)
Fixed code: import werkzeug
        _file = werkzeug.security.safe_join(STATIC_LOCATION, "code", filename)
        if _file is None:
            abort(404)
            if not os.path.isfile(_file):
                abort(404)
import werkzeug

    return send_from_directory(base_path, werkzeug.security.safe_join("", name, filename))