GHSA-75jv-vfxf-3865
Suggest an improvement- Source
- https://github.com/advisories/GHSA-75jv-vfxf-3865
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-75jv-vfxf-3865/GHSA-75jv-vfxf-3865.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-75jv-vfxf-3865
- Published
- 2025-07-25T14:15:48Z
- Modified
- 2025-07-25T16:57:04.591456Z
- Severity
-
- 10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H CVSS Calculator
- Summary
- Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code
- Details
-
Path-Traversal -> Arbitrary File Write in Assemblyline Service Client
1. Summary
The Assemblyline 4 service client (
task_handler.py) accepts a SHA-256 value returned by the service server and uses it directly as a local file name.No validation / sanitisation is performed.
A malicious or compromised server (or any MITM that can speak to client) can return a path-traversal payload such as
../../../etc/cron.d/evil
and force the client to write the downloaded bytes to an arbitrary location on disk.
2. Affected Versions
| Item | Value | |---|---| | Component |
assemblyline-service-client| | Repository | CybercentreCanada/assemblyline-service-client | | Affected | All releases up to master branch. |
4. Technical Details
| Field | Content | |---|---| | Location |
assemblyline_service_client/task_handler.py, insidedownload_file()| | Vulnerable Line |file_path = os.path.join(self.tasking_dir, sha256)| | Root Cause | Thesha256string is taken directly from the service-server JSON response and used as a file name without any validation or sanitisation. | | Exploit Flow | 1. Attacker (service server) returns HTTP 200 forGET /api/v1/file/../../../etc/cron.d/evil.<br>2. Client writes the response body to/etc/cron.d/evil.<br>3. Achieves arbitrary file write (code execution if file is executable). |
5. Impact
- Integrity – Overwrite any file writable by the service UID (often root).
- Availability – Corrupt critical files or exhaust disk space.
- Code Execution – Drop cron jobs, systemd units, or overwrite binaries.
6. Mitigation / Fix
import re _SHA256_RE = re.compile(r'^[0-9a-fA-F]{64}\Z') def download_file(self, sha256: str, sid: str) -> Optional[str]: if not _SHA256_RE.fullmatch(sha256): self.log.error(f"[{sid}] Invalid SHA256: {sha256}") self.status = STATUSES.ERROR_FOUND return None # or your preferred way to check if a string is a shasum. - Database specific
{ "github_reviewed": true, "severity": "CRITICAL", "github_reviewed_at": "2025-07-25T14:15:48Z", "cwe_ids": [ "CWE-23" ], "nvd_published_at": null }- References
Affected packages
PyPI / assemblyline-service-client
Package
- Name
- assemblyline-service-client
- View open source insights on deps.dev
- Purl
- pkg:pypi/assemblyline-service-client
PyPI / assemblyline-service-client
Package
- Name
- assemblyline-service-client
- View open source insights on deps.dev
- Purl
- pkg:pypi/assemblyline-service-client