Path Traversal Affecting paddlepaddle package, versions [,2.6.1)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-PADDLEPADDLE-6447884
- published 17 Mar 2024
- disclosed 7 Mar 2024
- credit pinkdraconian
How to fix?
Upgrade paddlepaddle to version 2.6.1 or higher.
Overview
paddlepaddle is a Parallel Distributed Deep Learning
Affected versions of this package are vulnerable to Path Traversal due to improper limitation of a pathname to a restricted directory. An attacker can overwrite arbitrary files by submitting a crafted input containing "../" sequences to traverse directories.
Notes:
On servers that have SSH enabled, an attacker may be able to inject their own public RSA key into the
authorized_keysfile, leading to remote code execution.On servers hosting web servers, various vulnerabilities can be exploited. On PHP or JSP server, remote code execution may be possible via uploading a webshell. On other servers an HTML file can be uploaded to achieve Cross-site Scripting (XSS)
Being able to overwrite files can also lead to impact in terms of availability. Overwriting configuration files, source code, and such may cause the server to not function properly anymore.