CVE-2022-25299: 
NixOS vulnerability analysis and mitigation

A directory traversal vulnerability was discovered in Mongoose, an embedded web server, affecting versions prior to 7.6. The vulnerability (CVE-2022-25299) was disclosed on February 13, 2022, and involves unsafe handling of file names during upload operations using the mg_http_upload() method (Snyk Report).

The vulnerability exists in the mg_http_upload() function where file names during upload operations are not properly sanitized. This allows attackers to manipulate file paths using '../' sequences to write files outside the intended target directory. The issue stems from insufficient path validation before file operations (Snyk Blog).

The vulnerability enables attackers to write files to arbitrary locations outside the designated target folder on the system. This could lead to system compromise through unauthorized file writes, potentially affecting system integrity and security. The vulnerability received a CVSS score of 9.8 (Critical) due to its network attack vector, low attack complexity, and high impact on system integrity (Snyk Report).

The vulnerability can be exploited remotely without requiring any special privileges or user interaction. A proof of concept exploit involves using a simple curl command: curl -X POST --data "pwned" "http://localhost:8000/upload?name=../pwned" to write files outside the intended directory (Snyk Report).

The vulnerability was fixed in Mongoose version 7.6 by adding path sanitization using the remove_double_dots() function to prevent directory traversal attempts. The fix ensures that file paths are properly validated before any file operations are performed (GitHub Commit).