Vulnerability DatabaseCVE-2022-39345

CVE-2022-39345:
vulnerability analysis and mitigation

Overview

CVE-2022-39345 is a path traversal vulnerability discovered in gin-vue-admin versions prior to 2.5.4. The vulnerability was reported on October 23, 2022, and affects the plugin installation functionality of the application. The issue allows attackers to perform arbitrary file uploads through directory traversal attacks (GitHub Advisory).

Technical details

The vulnerability exists in the plugin installation function where users can download and upload zip packages from the plugin market. The issue stems from insufficient validation in the utils.Unzip method, which automatically decompresses uploaded files without proper path validation. The vulnerability is classified under CWE-22 and CWE-23, relating to path traversal. The flaw is specifically located in the server/service/system/sys_auto_code.go file at line 880 (GitHub Advisory).

Impact

When exploited, this vulnerability allows malicious attackers to upload specially crafted zip packages that can traverse directories and upload or overwrite arbitrary files on the server side. This could potentially lead to remote code execution if server-side script files are uploaded (GitHub Advisory).

Mitigation and workarounds

The vulnerability has been patched in version 2.5.4 of gin-vue-admin. Users are advised to upgrade to this version or later to mitigate the risk. The fix was implemented through pull request #1264 (GitHub Advisory).