CVE-2023-49793: 
Python vulnerability analysis and mitigation

CodeChecker, an analyzer tooling and defect database for Clang Static Analyzer and Clang Tidy, contains a path traversal vulnerability in versions prior to 6.23.0. The vulnerability exists in the server endpoint of CodeChecker store where ZIP files are not properly sanitized. This security issue was discovered and disclosed on June 24, 2024, affecting all versions of CodeChecker before version 6.23.0 (GitHub Advisory).

The vulnerability is identified as CVE-2023-49793 with a CVSS v3.1 base score of 6.5 (Medium). The vulnerable endpoint is /Default/v6.53/CodeCheckerService@massStoreRun. The path traversal vulnerability stems from improper sanitization of ZIP files during the upload process. When the ZIP file is uploaded, it is first unzipped to a temporary directory, but the paths specified in the content_hashes.json file within the ZIP are not properly validated. This allows an attacker to use path traversal sequences (../../) to access files outside the intended directory (GitHub Advisory).

The vulnerability allows an attacker to read data on the machine running the CodeChecker server, with the same permission level as the CodeChecker server process. This enables potential exfiltration of data from the server-side storage medium. The attack requires a user account on the CodeChecker server with permissions to store to a server and view the stored report (GitHub Advisory, NVD).

The vulnerability is exploitable through a specially crafted ZIP file containing manipulated content_hashes.json. The attacker can control the insertion of arbitrary files into CodeChecker's internal database by providing sufficient path traversal sequences. The exploited files can then be displayed in the Web UI if accompanied by at least one bug report. The attack requires authentication if the CodeChecker server is configured with authentication enabled (GitHub Advisory).

The vulnerability has been patched in CodeChecker version 6.23.0. Users are advised to upgrade to this version or later to mitigate the security risk. The fix includes improved sanitization of file paths during the ZIP file processing (GitHub Advisory, Patch).