Directory Traversal Vulnerability in Psensor Package
Summary
DEBIAN-CVE-2014-10073: The create_response function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a file is under the webserver directory. Affects psensor versions < 1.1.5-1. Fixed in 1.1.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Psensor is a graphical hardware temperature monitoring tool that allows users to monitor the temperature of various components in their systems. It provides real-time data visualization and alerts for temperature thresholds. However, prior to version 1.1.4, Psensor had a critical vulnerability that allowed unauthorized access to files outside the intended webserver directory, posing a significant security risk.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2014-10073 exists in the create_response function within server/server.c of Psensor versions before 1.1.4. This flaw allows for Directory Traversal attacks, where an attacker can manipulate file paths to access sensitive files on the server. The lack of proper validation checks means that files outside the webserver directory can be accessed, potentially leading to data leakage or unauthorized access to system files.
How To Fix
Minimum fixed version
1.1.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade psensorTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the webserver directory and implement additional security measures, such as file permission adjustments, to mitigate the risk of unauthorized file access until the package can be updated.
Conclusion
The Directory Traversal vulnerability in the Psensor package poses a significant risk to users running versions prior to 1.1.4. It is crucial to update to the latest version to protect against potential attacks. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for psensor →
FAQ
A Directory Traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory structure of a web application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The consequences can include unauthorized access to sensitive files, data leakage, and potential exploitation of the server, leading to further security breaches.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If an immediate update is not possible, implement strict access controls and monitor your server for any suspicious activity as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for psensor.
