cvelistv5 - cve-2025-55013

cve-2025-55013

Vulnerability from cvelistv5

Published

2025-08-09 02:02

Modified

2025-08-12 13:26

Severity ?

4.2 (Medium) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Summary

Assemblyline 4 Service Client: Arbitrary Write through path traversal in Client code

References

▼	URL	Tags
	security-advisories@github.com	https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900
	security-advisories@github.com	https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865

Impacted products

▼	Vendor	Product
	CybercentreCanada	assemblyline

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-55013",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-11T14:07:26.606408Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-11T14:07:39.454Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "assemblyline",
          "vendor": "CybercentreCanada",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.6.1.dev138"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Assemblyline 4 Service Client interfaces with the API to fetch tasks and publish the result for a service in Assemblyline 4. In versions below 4.6.1.dev138, the Assemblyline 4 Service Client (task_handler.py) accepts a SHA-256 value returned by the service server and uses it directly as a local file name.A malicious or compromised server (or any MITM that can speak to client) can return a path-traversal payload such as `../../../etc/cron.d/evil` and force the client to write the downloaded bytes to an arbitrary location on disk. This is fixed in version 4.6.1.dev138."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23: Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-12T13:26:26.900Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865"
        },
        {
          "name": "https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900"
        }
      ],
      "source": {
        "advisory": "GHSA-75jv-vfxf-3865",
        "discovery": "UNKNOWN"
      },
      "title": "Assemblyline 4 Service Client: Arbitrary Write through path traversal in Client code"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-55013",
    "datePublished": "2025-08-09T02:02:23.602Z",
    "dateReserved": "2025-08-04T17:34:24.422Z",
    "dateUpdated": "2025-08-12T13:26:26.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-55013\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-08-09T03:15:47.620\",\"lastModified\":\"2025-08-12T14:15:29.400\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Assemblyline 4 Service Client interfaces with the API to fetch tasks and publish the result for a service in Assemblyline 4. In versions below 4.6.1.dev138, the Assemblyline 4 Service Client (task_handler.py) accepts a SHA-256 value returned by the service server and uses it directly as a local file name.A malicious or compromised server (or any MITM that can speak to client) can return a path-traversal payload such as `../../../etc/cron.d/evil` and force the client to write the downloaded bytes to an arbitrary location on disk. This is fixed in version 4.6.1.dev138.\"},{\"lang\":\"es\",\"value\":\"Assemblyline 4 Service Client interact\u00faa con la API para obtener tareas y publicar el resultado de un servicio en Assemblyline 4. En versiones anteriores a la 4.6.1.dev138, el cliente de servicio de Assemblyline 4 (task_handler.py) acepta un valor SHA-256 devuelto por el servidor de servicio y lo usa directamente como nombre de archivo local. Un servidor malicioso o comprometido (o cualquier MITM que pueda comunicarse con el cliente) puede devolver un payload de path traversal como `../../../etc/cron.d/evil` y obligar al cliente a escribir los bytes descargados en una ubicaci\u00f3n arbitraria del disco. Esto se solucion\u00f3 en la versi\u00f3n 4.6.1.dev138.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L\",\"baseScore\":4.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.6,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-23\"}]}],\"references\":[{\"url\":\"https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865\",\"source\":\"security-advisories@github.com\"}]}}"
  }
}

ghsa-75jv-vfxf-3865

Vulnerability from github

Published

2025-07-25 14:15

Modified

2025-08-12 13:26

Severity ?

4.2 (Medium) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Summary

Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code

Details

Path-Traversal -> Arbitrary File Write in Assemblyline Service Client

IMPORTANT: This vulnerability is valid if you decide to use the assemblyline-service-client outside of the normal practice to using Assemblyline in a production environment. In practice, this code should always be executed within a containerized environment such as assemblyline-v4-service which ensures filesystem-level permissions of what the running user is allowed to access. Furthermore, there is fewer chances for a MiTM compromise when deployed properly in a Docker or Kubernetes deployment where the platform will assign the correct network policies to secure connections between containers instead of relying on the user to set this up manually.

See https://github.com/CybercentreCanada/assemblyline/issues/382 for further discussion.

1. Summary

The Assemblyline 4 service client (task_handler.py) accepts a SHA-256 value returned by the service server and uses it directly as a local file name.

No validation / sanitisation is performed.

A malicious or compromised server (or any MITM that can speak to client) can return a path-traversal payload such as
../../../etc/cron.d/evil
and force the client to write the downloaded bytes to an arbitrary location on disk.

2. Affected Versions

| Item | Value | |---|---| | Component | assemblyline-service-client | | Repository | CybercentreCanada/assemblyline-service-client | | Affected | All releases up to master branch. |

3. CVSS 3.1 Vector & Score

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

4. Technical Details

| Field | Content | |---|---| | Location | assemblyline_service_client/task_handler.py, inside download_file() | | Vulnerable Line | file_path = os.path.join(self.tasking_dir, sha256) | | Root Cause | The sha256 string is taken directly from the service-server JSON response and used as a file name without any validation or sanitisation. | | Exploit Flow | 1. Attacker (service server) returns HTTP 200 for GET /api/v1/file/../../../etc/cron.d/evil.
2. Client writes the response body to /etc/cron.d/evil.
3. Achieves arbitrary file write (code execution if file is executable). |

5. Impact

Integrity – Overwrite any file writable by the service UID (often root).
Availability – Corrupt critical files or exhaust disk space.
Code Execution – Drop cron jobs, systemd units, or overwrite binaries.

6. Mitigation / Fix

```python import re

_SHA256_RE = re.compile(r'^[0-9a-fA-F]{64}\Z')

def download_file(self, sha256: str, sid: str) -> Optional[str]: if not _SHA256_RE.fullmatch(sha256): self.log.error(f"[{sid}] Invalid SHA256: {sha256}") self.status = STATUSES.ERROR_FOUND return None # or your preferred way to check if a string is a shasum. ```

Show details on source website