-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| assemblyline-service-client | pip | < 4.6.0.stable11 | 4.6.0.stable11 |
| assemblyline-service-client | pip | >= 4.6.1.dev0, < 4.6.1.dev138 | 4.6.1.dev138 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the assemblyline-service-client library, specifically within the download_file method of the TaskHandler class. The root cause is the lack of input validation on the sha256 parameter, which is received from a service server. A malicious or compromised server can send a path traversal string (e.g., ../../../tmp/pwned) instead of a valid SHA256 hash. The client code then concatenates this malicious string with a base directory and attempts to write a file to that location. This allows an attacker to write arbitrary files to any location on the filesystem where the user running the service client has write permissions. The provided patch confirms this by adding a regular expression check to validate the format of the sha256 string, ensuring it is a legitimate hash before it is used to construct a file path. The identified function TaskHandler.download_file is the exact location where the vulnerable code exists and where the fix was applied.
import re
_SHA256_RE = re.compile(r'^[0-9a-fA-F]{64}\Z')
def download_file(self, sha256: str, sid: str) -> Optional[str]:
if not _SHA256_RE.fullmatch(sha256):
self.log.error(f"[{sid}] Invalid SHA256: {sha256}")
self.status = STATUSES.ERROR_FOUND
return None
# or your preferred way to check if a string is a shasum.
Ongoing coverage of React2Shell