Description (CNA)
Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in the workspace field and subsequently use relative paths in the session file API to access any file readable by the WebUI process.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| nesquena / hermes-webui | affected 0 before 0.51.44; unaffected f00cb74f776f22f02f5eb6b39dfb389f87cc7fd3 |
CWE
CWE-22
References
- https://github.com/nesquena/hermes-webui/releases/tag/v0.51.44
- https://github.com/nesquena/hermes-webui/pull/2048
- https://github.com/nesquena/hermes-webui/commit/f00cb74f776f22f02f5eb6b39dfb389f87cc7fd3
- https://www.vulncheck.com/advisories/hermes-webui-path-traversal-via-session-import-endpoint
ADP enrichment
No English description supplied.