CVE-2024-47818

Name of the Vulnerable Software and Affected Versions Saltcorn versions prior to 1.0.0-beta16

Description A logged-in user with any role can delete arbitrary files on the filesystem by calling the /sync/clean sync dir endpoint. The dir name POST parameter is not validated/sanitized and is used to construct the syncDir that is deleted by calling fs.rm. This issue allows for arbitrary file deletion.

Recommendations For versions prior to 1.0.0-beta16, upgrade to release version 1.0.0-beta16 or later to address the issue. As a temporary workaround, consider implementing input validation for the dir name parameter to ensure it does not contain malicious paths. Restrict access to the /sync/clean sync dir endpoint to minimize the risk of exploitation.