CVE-2022-25377: Appwrite Directory Traversal vulnerability
Summary
CVE-2022-25377: Appwrite Directory Traversal vulnerability. Affects appwrite/server-ce versions >= 0.5.0, < 0.12.2. Fixed in 0.12.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Appwrite is an open-source backend server that helps developers build web and mobile applications faster. It provides various features such as user authentication, database management, file storage, and more. The vulnerability in question affects Appwrite versions 0.5.0 through 0.12.x before 0.12.2. It specifically targets the ACME-challenge endpoint, which is responsible for handling Let's Encrypt certificates. By exploiting a directory traversal flaw, remote attackers can read arbitrary local files. However, for the vulnerability to be exploitable, the file 'APP_STORAGE_CERTIFICATES/.well-known/acme-challenge' must exist on the disk.
Vulnerability Detail
The directory traversal vulnerability in the ACME-challenge endpoint of Appwrite allows attackers to access sensitive files on the server. By manipulating the file path using '../' sequences, an attacker can bypass the intended access restrictions and read arbitrary files. This can lead to unauthorized disclosure of sensitive information, such as configuration files, credentials, or other sensitive data stored on the server. It is important to note that this vulnerability requires the presence of the 'APP_STORAGE_CERTIFICATES/.well-known/acme-challenge' file on the server.
How To Fix
Minimum fixed version
0.12.2
This is the first release that contains the fix.
composer require appwrite/server-ce:0.12.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually removing the 'APP_STORAGE_CERTIFICATES/.well-known/acme-challenge' file from the server. By removing this file, the directory traversal vulnerability is mitigated. However, it is crucial to ensure that the Let's Encrypt certificate installation process is not disrupted or affected by this workaround. It is recommended to consult the Appwrite documentation or seek assistance from the Appwrite community for guidance on implementing this workaround effectively.
Conclusion
The Appwrite Directory Traversal vulnerability (CVE-2022-25377) exposes sensitive files on the server to unauthorized access. Upgrading to Appwrite version 0.12.2 or later is the recommended solution to fix this vulnerability. Alternatively, manually removing the 'APP_STORAGE_CERTIFICATES/.well-known/acme-challenge' file can serve as a temporary workaround. For further assistance or information on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for appwrite/server-ce →
FAQ
Appwrite is an open-source backend server that helps developers build web and mobile applications faster. It provides various features such as user authentication, database management, file storage, and more.
The ACME-challenge endpoint is a part of Appwrite that handles Let's Encrypt certificate installation. It allows the server to prove its control over the domain by responding to a specific challenge.
The directory traversal vulnerability in Appwrite's ACME-challenge endpoint allows attackers to bypass access restrictions and read arbitrary files on the server. By manipulating the file path using '../' sequences, they can navigate to directories outside the intended scope and access sensitive information.
The vulnerability can lead to unauthorized disclosure of sensitive information stored on the server. This includes configuration files, credentials, or any other sensitive data that may be accessible through the exploited file path.
To protect your Appwrite installation, it is crucial to upgrade to version 0.12.2 or later. Additionally, ensure that the 'APP_STORAGE_CERTIFICATES/.well-known/acme-challenge' file is properly secured and inaccessible to unauthorized users.
References
Related vulnerabilities
Recent vulnerabilities recorded for appwrite/server-ce.
