CVE-2019-10767: Arbitrary File Write in iobroker.js-controller
Summary
CVE-2019-10767: Arbitrary File Write in iobroker.js-controller. Affects iobroker.js-controller versions < 2.0.25. Fixed in 2.0.25. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The iobroker.js-controller package is an npm package used for controlling and managing IOBroker, an open-source home automation platform. It provides a framework for integrating various smart devices and systems. The package is vulnerable to a Path Traversal issue, allowing attackers to write arbitrary files outside of the intended directory. By exploiting this vulnerability, an authenticated attacker can include malicious files in the system.
Vulnerability Detail
The vulnerability in iobroker.js-controller arises from its failure to properly restrict access to folders outside of the intended /adapter/<adapter-name> folder. This allows an attacker to traverse the file system and write arbitrary files, potentially leading to remote code execution or unauthorized access to sensitive information. Although authentication is required to exploit this vulnerability, the package has authentication disabled by default, making it easier for attackers to perform the attack.
How To Fix
Minimum fixed version
2.0.25
This is the first release that contains the fix.
npm install iobroker.js-controller@2.0.25Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can enable authentication in the iobroker.js-controller package to mitigate the risk of exploitation. By enabling authentication, even if the package has it disabled by default, it adds an extra layer of security and reduces the likelihood of unauthorized access.
Conclusion
The iobroker.js-controller package prior to version 2.0.25 is vulnerable to Path Traversal, allowing authenticated attackers to write arbitrary files outside of the intended directory. To mitigate this vulnerability, it is crucial to upgrade to the latest version of the package. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for iobroker.js-controller →
FAQ
The vulnerability allows an authenticated attacker to write arbitrary files outside of the intended directory. This can lead to remote code execution or unauthorized access to sensitive information.
Yes, authentication is required to exploit this vulnerability. However, the iobroker.js-controller package has authentication disabled by default, making it easier for attackers to perform the attack.
To fix this vulnerability, upgrade to version 2.0.25 or later of the iobroker.js-controller package.
Enabling authentication in the iobroker.js-controller package can serve as a workaround to mitigate the risk of exploitation.
For more information about this vulnerability, refer to the GitHub Security Advisory GHSA-cmch-296j-wfvw.
