Staging Environment: Content and features may be unstable or change without notice.
Advisory details: ruby_advisory_db / gems/camaleon_cms/CVE-2024-46986
Advisory ID ruby_advisory_db/gems/camaleon_cms/CVE-2024-46986
Aliases CVE-2024-46986
GHSA-wmjg-vqhv-q5p5
Summary Camaleon CMS affected by arbitrary file write to RCE (GHSL-2024-182) An arbitrary file write vulnerability accessible via the upload method of the `MediaController` allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on (depending on the permissions of the underlying filesystem). E.g. This can lead to a delayed remote code execution in case an attacker is able to write a Ruby file into the `config/initializers/` subfolder of the Ruby on Rails application. Once a user upload is started via the [upload] method, the `file_upload` and the folder parameter. [upload]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L86-L87 ```ruby def upload(settings = {}) params[:dimension] = nil if params[:skip_auto_crop].present? f = { error: 'File not found.' } if params[:file_upload].present? f = upload_file(params[:file_upload], { folder: params[:folder], dimension: params['dimension'], formats: params[:formats], versions: params[:versions], thumb_size: params[:thumb_size] }.merge(settings)) end [..] end ``` are passed to the [upload_file] method. Inside that method the given settings are [merged] with some presets. The file format is [checked against] the formats settings we can override with the formats parameters. [upload_file]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/helpers/camaleon_cms/uploader_helper.rb#L23-L24 [merged]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/helpers/camaleon_cms/uploader_helper.rb#L41-L42 [checked against]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/helpers/camaleon_cms/uploader_helper.rb#L61-L62 ```ruby # formats validations return { error: "#{ct('file_format_error')} (#{settings[:formats]})" } unless cama_uploader.class.validate_file_format( uploaded_io.path, settings[:formats] ) ``` Our given folder is then [passed unchecked] to the `Cama_uploader`: [passed unchecked]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/helpers/camaleon_cms/uploader_helper.rb#L73-L74 ```ruby key = File.join(settings[:folder], settings[:filename]).to_s.cama_fix_slash res = cama_uploader.add_file(settings[:uploaded_io], key, { same_name: settings[:same_name] }) ``` In the [add_file] method of `CamaleonCmsLocalUploader` this key argument containing the unchecked path is then used to write the file to the file system: [add_file]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_local_uploader.rb#L77 ```ruby def add_file(uploaded_io_or_file_path, key, args = {}) [..] upload_io = uploaded_io_or_file_path.is_a?(String) ? File.open(uploaded_io_or_file_path) : uploaded_io_or_file_path File.open(File.join(@root_folder, key), 'wb') { |file| file.write(upload_io.read) } [..] end ``` ## Impact This issue may lead up to Remote Code Execution (RCE) via arbitrary file write. ## Remediation Normalize file paths constructed from untrusted user input before using them and check that the resulting path is inside the targeted directory. Additionally, do not allow character sequences such as `..` in untrusted input that is used to build paths. ## See Also [CodeQL: Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/ruby/rb-path-injection/) [OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv3 9.9
cvssv4 8.7
Reference id Reference type URL
GHSA-wmjg-vqhv-q5p5 https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-wmjg-vqhv-q5p5
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-09-18T19:00:17Z/

Decision: Track*

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2024/46xxx/CVE-2024-46986.json

Source Advisory: vulnrichment/CVE-2024-46986

View SSVC decision tree 
[{'Exploitation': 'poc'},
 {'Automatable': 'no'},
 {'Technical Impact': 'total'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]