CVE-2019-10765: Arbitrary File Write in iobroker.admin
Summary
CVE-2019-10765: Arbitrary File Write in iobroker.admin. Affects iobroker.admin versions < 3.6.12. Fixed in 3.6.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The iobroker.admin package is an npm package used for managing and administering the ioBroker smart home platform. It provides a web-based interface for users to configure and control their smart home devices. The package is vulnerable to a Path Traversal issue, allowing attackers to write arbitrary files on the system. The vulnerability exists in versions prior to 3.6.12. Although authentication is required to exploit the vulnerability, the package has authentication disabled by default.
Vulnerability Detail
The Path Traversal vulnerability in iobroker.admin allows attackers to access files outside of the intended folder in the /log/ route. By manipulating the file path, an authenticated attacker can include arbitrary files in the system. This could lead to unauthorized access, data leakage, or even remote code execution depending on the nature of the included files. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
3.6.12
This is the first release that contains the fix.
npm install iobroker.admin@3.6.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can enable authentication for the iobroker.admin package to mitigate the risk of exploitation. By enabling authentication, only authenticated users will have access to the package's functionalities, reducing the attack surface. Here is an example of how to enable authentication in the iobroker.admin configuration:
// Add the following line to the `iobroker-data/iobroker.json` file
"auth": true
Please note that enabling authentication may require additional configuration and user management.
Conclusion
The iobroker.admin package prior to version 3.6.12 is vulnerable to a Path Traversal issue that allows authenticated attackers to write arbitrary files on the system. To mitigate the vulnerability, it is recommended to upgrade to the latest version and enable authentication. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for iobroker.admin →
FAQ
The vulnerability allows authenticated attackers to write arbitrary files on the system, potentially leading to unauthorized access, data leakage, or remote code execution.
No, only versions prior to 3.6.12 are affected. It is recommended to upgrade to the latest version to mitigate the vulnerability.
Yes, authentication is required to exploit the vulnerability. However, the iobroker.admin package has authentication disabled by default, increasing the risk of exploitation.
To fix the vulnerability, upgrade to version 3.6.12 or later of the iobroker.admin package. Ensure that authentication is enabled and properly configured to mitigate the risk of exploitation.
Yes, as a workaround, users can enable authentication for the iobroker.admin package. This reduces the attack surface by allowing only authenticated users to access the package's functionalities.
