CVE-2024-25123 (published 2024-02-15T22:15Z)

MSS (Mission Support System) is an open source package designed for planning atmospheric research flights. In file: `index.py`, there is a method that is vulnerable to path manipulation attack. By modifying file paths, an attacker can acquire sensitive information from different resources. The `filename` variable is joined with other variables to form a file path in `_file`. However, `filename` is a route parameter that can capture path type values i.e. values including slashes (\\). So it is possible for an attacker to manipulate the file being read by assigning a value containing ../ to `filename` and so the attacker may be able to gain access to other files on the host filesystem. This issue has been addressed in MSS version 8.3.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Open-MSS/MSS
commit_details: repo_url: https://github.com/Open-MSS/MSS
author: Matthias Riße
author_date: 2024-02-08 16:00:40+01:00
msg: Merge pull request from GHSA-pf2h-qjcr-qvq2
repository: repo_url: https://github.com/Open-MSS/MSS
repo_name: Open-MSS/MSS
description: A QT application, a OGC web map server, a collaboration server to plan atmospheric research flights.
repo_language: Python
owner: Open-MSS
file_changes: filename: index.py
change_type: ModificationType.MODIFY
diff: @@ -29,6 +29,7 @@ import sys
 import os
 import codecs
 import mslib
+import werkzeug
 
 from flask import render_template
 from flask import send_from_directory, send_file, url_for
@@ -161,11 +162,15 @@ def create_app(name=""):
     @APP.route("/mss/code/<path:filename>")
     def code(filename):
         download = request.args.get("download", False)
-        _file = os.path.join(STATIC_LOCATION, 'code', filename)
+        _file = werkzeug.security.safe_join(STATIC_LOCATION, "code", filename)
+        if _file is None:
+            abort(404)
         content = get_content(_file)
         if not download:
             return render_template("/content.html", act="code", content=content)
         else:
+            if not os.path.isfile(_file):
+                abort(404)
             with open(_file) as f:
                 text = f.read()
             return Response("".join([s.replace("\t", "", 1) for s in text.split("```python")[-1]

programming_language: Python
filename: server.py
change_type: ModificationType.MODIFY
diff: @@ -34,6 +34,8 @@ import fs
 import os
 import socketio
 import sqlalchemy.exc
+import werkzeug
+
 from itsdangerous import URLSafeTimedSerializer, BadSignature
 from flask import g, jsonify, request, render_template, flash
 from flask import send_from_directory, abort, url_for
@@ -378,7 +380,7 @@ def uploads(name=None, filename=None):
         abort(404)
     if filename is None:
         abort(404)
-    return send_from_directory(fs.path.join(base_path, name), filename)
+    return send_from_directory(base_path, werkzeug.security.safe_join("", name, filename))
 
 
 # 413: Payload Too Large

programming_language: Python