CVE-2022-31507: 
Python vulnerability analysis and mitigation

The ganga-devs/ganga repository before version 8.5.10 contained a path traversal vulnerability (CVE-2022-31507) due to unsafe usage of the Flask send_file function. The vulnerability was discovered and disclosed in June 2022, affecting the web interface component of the Ganga software (NIST NVD, CISA Bulletin).

The vulnerability stems from improper validation of user input in the job_browse function where os.path.join is used unsafely with the Flask send_file function. When os.path.join encounters an absolute path, it ignores all previous parameters, allowing attackers to traverse directories outside the intended web root folder. The vulnerability has a CVSS v3.1 base score of 6.4, indicating moderate severity (NIST NVD, GitHub Commit).

The vulnerability allows remote attackers to access files and directories stored outside the web root folder through path traversal techniques. This could potentially expose sensitive system files, application source code, and configuration files. The attack can affect components outside the scope of the target module and can be used to gain access to confidential files like passwords and login credentials (GitHub Commit).

The vulnerability can be exploited remotely without requiring authentication or user interaction. A proof of concept exploit involves making HTTP requests with path traversal sequences like '../' to access files outside the intended directory. For example: 'curl --path-as-is http:///job//browse///../../../../etc/passwd' (GitHub Commit).

The vulnerability was fixed in version 8.5.10 by replacing the unsafe os.path.join call with werkzeug.utils.safe_join. For applications requiring similar functionality, it is recommended to either use werkzeug.utils.safe_join for joining untrusted paths or replace flask.send_file calls with flask.send_from_directory calls (GitHub Release, GitHub Commit).