ghsa-75jv-vfxf-3865
Vulnerability from github
Path-Traversal -> Arbitrary File Write in Assemblyline Service Client
IMPORTANT: This vulnerability is valid if you decide to use the assemblyline-service-client outside of the normal practice to using Assemblyline in a production environment. In practice, this code should always be executed within a containerized environment such as assemblyline-v4-service which ensures filesystem-level permissions of what the running user is allowed to access. Furthermore, there is fewer chances for a MiTM compromise when deployed properly in a Docker or Kubernetes deployment where the platform will assign the correct network policies to secure connections between containers instead of relying on the user to set this up manually.
See https://github.com/CybercentreCanada/assemblyline/issues/382 for further discussion.
1. Summary
The Assemblyline 4 service client (task_handler.py) accepts a SHA-256 value returned by the service server and uses it directly as a local file name.
No validation / sanitisation is performed.
A malicious or compromised server (or any MITM that can speak to client) can return a path-traversal payload such as
../../../etc/cron.d/evil
and force the client to write the downloaded bytes to an arbitrary location on disk.
2. Affected Versions
| Item | Value |
|---|---|
| Component | assemblyline-service-client |
| Repository | CybercentreCanada/assemblyline-service-client |
| Affected | All releases up to master branch. |
3. CVSS 3.1 Vector & Score
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
4. Technical Details
| Field | Content |
|---|---|
| Location | assemblyline_service_client/task_handler.py, inside download_file() |
| Vulnerable Line | file_path = os.path.join(self.tasking_dir, sha256) |
| Root Cause | The sha256 string is taken directly from the service-server JSON response and used as a file name without any validation or sanitisation. |
| Exploit Flow | 1. Attacker (service server) returns HTTP 200 for GET /api/v1/file/../../../etc/cron.d/evil.
2. Client writes the response body to /etc/cron.d/evil.
3. Achieves arbitrary file write (code execution if file is executable). |
5. Impact
- Integrity – Overwrite any file writable by the service UID (often root).
- Availability – Corrupt critical files or exhaust disk space.
- Code Execution – Drop cron jobs, systemd units, or overwrite binaries.
6. Mitigation / Fix
```python import re
_SHA256_RE = re.compile(r'^[0-9a-fA-F]{64}\Z')
def download_file(self, sha256: str, sid: str) -> Optional[str]: if not _SHA256_RE.fullmatch(sha256): self.log.error(f"[{sid}] Invalid SHA256: {sha256}") self.status = STATUSES.ERROR_FOUND return None # or your preferred way to check if a string is a shasum. ```
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "assemblyline-service-client"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.0.stable11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "assemblyline-service-client"
},
"ranges": [
{
"events": [
{
"introduced": "4.6.1.dev0"
},
{
"fixed": "4.6.1.dev138"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-55013"
],
"database_specific": {
"cwe_ids": [
"CWE-23"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-25T14:15:48Z",
"nvd_published_at": "2025-08-09T03:15:47Z",
"severity": "MODERATE"
},
"details": "**Path-Traversal -\u003e Arbitrary File Write in Assemblyline Service Client**\n\n**IMPORTANT**: This vulnerability is valid if you decide to use the assemblyline-service-client outside of the normal practice to using Assemblyline in a production environment. In practice, this code should always be executed within a containerized environment such as [assemblyline-v4-service](https://github.com/CybercentreCanada/assemblyline-v4-service) which ensures filesystem-level permissions of what the running user is allowed to access. Furthermore, there is fewer chances for a MiTM compromise when deployed properly in a Docker or Kubernetes deployment where the platform will assign the correct network policies to secure connections between containers instead of relying on the user to set this up manually.\n\nSee https://github.com/CybercentreCanada/assemblyline/issues/382 for further discussion.\n\n---\n\n## 1. Summary \nThe Assemblyline 4 **service client** (`task_handler.py`) accepts a SHA-256 value returned by the service **server** and uses it directly as a local file name. \n\u003e No validation / sanitisation is performed.\n\nA **malicious or compromised server** (or any MITM that can speak to client) can return a path-traversal payload such as \n`../../../etc/cron.d/evil` \nand force the client to write the downloaded bytes to an arbitrary location on disk.\n\n---\n\n## 2. Affected Versions \n| Item | Value |\n|---|---|\n| **Component** | `assemblyline-service-client` |\n| **Repository** | [CybercentreCanada/assemblyline-service-client](https://github.com/CybercentreCanada/assemblyline-service-client) |\n| **Affected** | **All releases up to master branch.** |\n\n\n---\n\n## 3. CVSS 3.1 Vector \u0026 Score \n```\nCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L\n```\n\n\n---\n\n## 4. Technical Details\n\n| Field | Content |\n|---|---|\n| **Location** | `assemblyline_service_client/task_handler.py`, inside `download_file()` |\n| **Vulnerable Line** | `file_path = os.path.join(self.tasking_dir, sha256)` |\n| **Root Cause** | The `sha256` string is taken directly from the service-server JSON response and used as a file name without any validation or sanitisation. |\n| **Exploit Flow** | 1. Attacker (service server) returns HTTP 200 for `GET /api/v1/file/../../../etc/cron.d/evil`.\u003cbr\u003e2. Client writes the response body to `/etc/cron.d/evil`.\u003cbr\u003e3. Achieves arbitrary file write (code execution if file is executable). |\n\n---\n\n## 5. Impact \n- **Integrity** \u2013 Overwrite any file writable by the service UID (often root). \n- **Availability** \u2013 Corrupt critical files or exhaust disk space. \n- **Code Execution** \u2013 Drop cron jobs, systemd units, or overwrite binaries.\n\n---\n\n## 6. Mitigation / Fix\n\n```python\nimport re\n\n_SHA256_RE = re.compile(r\u0027^[0-9a-fA-F]{64}\\Z\u0027)\n\ndef download_file(self, sha256: str, sid: str) -\u003e Optional[str]:\n if not _SHA256_RE.fullmatch(sha256):\n self.log.error(f\"[{sid}] Invalid SHA256: {sha256}\")\n self.status = STATUSES.ERROR_FOUND\n return None\n # or your preferred way to check if a string is a shasum.\n```\n---",
"id": "GHSA-75jv-vfxf-3865",
"modified": "2025-08-12T13:26:14Z",
"published": "2025-07-25T14:15:48Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55013"
},
{
"type": "WEB",
"url": "https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900"
},
{
"type": "PACKAGE",
"url": "https://github.com/CybercentreCanada/assemblyline-service-client"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code "
}
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.