WhoDB has a path traversal opening Sqlite3 database
Date: 2025-02
Affected: go/github.com/clidey/whodb/core
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2025-24786
CWE: CWE-22
CVSS: 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)

### Summary While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database present on the host machine that the application is running on. ### Details WhoDB allows users to connect to Sqlite3 databases. By default, the databases must be present in `/db/` (or alternatively `./tmp/` if development mode is enabled). Source: https://github.com/clidey/whodb/blob/ba6eb81d0ca40baead74bca58b2567166999d6a6/core/src/plugins/sqlite3/db.go#L14-L20 If no databases are present in the default directory, the UI indicates that the user is unable to open any databases: ![2025-01-22-12-12-42](https://github.com/user-attachments/assets/98ffbcf6-907d-4f90-bf11-2c921b2d93b3) The database file is an user-controlled value. This value is used in `.Join()` with the default directory, in order to get the full path of the database file to open. Source: https://github.com/clidey/whodb/blob/ba6eb81d0ca40baead74bca58b2567166999d6a6/core/src/plugins/sqlite3/db.go#L26 No checks are performed whether the database file that is eventually opened actually resides in the default directory `/db`. This allows an attacker to use path traversal (`../../`) in order to open any Sqlite3 database present on the system. ### PoC Before running the container, an example Sqlite3 database with dummy "secret" data was created: ```sh DB_FILE=$(mktemp) echo "CREATE TABLE secret_ta


Mitigations:

Architectural layers (MAESTRO):