CVE-2022-24900

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-24900
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24900.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-24900
Aliases
  • GHSA-g78x-q3x8-r6m4
Published
2022-04-29T14:15:11Z
Modified
2024-05-23T01:28:49.611051Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The os.path.join call is unsafe for use with untrusted input. When the os.path.join call encounters an absolute path, it ignores all the parameters it has encountered till that point and starts working with the new absolute path. Since the "malicious" parameter represents an absolute path, the result of os.path.join ignores the static directory completely. Hence, untrusted input is passed via the os.path.join call to flask.send_file can lead to path traversal attacks. A patch with a fix is available on the master branch of the GitHub repository. This can also be fixed by preventing flow of untrusted data to the vulnerable send_file function. In case the application logic necessiates this behaviour, one can either use the flask.safe_join to join untrusted paths or replace flask.send_file calls with flask.send_from_directory calls.

References

Affected packages

Git / github.com/onlaj/piano-led-visualizer

Affected ranges

Type
GIT
Repo
https://github.com/onlaj/piano-led-visualizer
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

v1.*

v1.00
v1.1
v1.2
v1.3