GHSA-cw6g-qmjq-6w2w: Arbitrary File Read via Email Template Abuse with PoC

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Read Arbitrary System Files 2. Severity: High (7.7/10) 3. Publisher: angrybrad 4. Vulnerability ID: GHSA-cw6g-qmjq-6w2w 5. Published Date: 4 days ago 6. Affected Versions: - >= 5.0.0-alpha.1, = 4.0.0-alpha.1, = 3.5.13 7. Fixed Versions: - 5.4.9 - 4.12.8 8. Description: - Attackers can read arbitrary operating system files by abusing email notification templates. - Attackers need write access to system notification templates and the ability to trigger corresponding system emails. 9. PoC: - Modify the template to include the following Twig template string: - Trigger the corresponding notification email (e.g., password reset) - Receive the email and decode the Base64 string 10. Email Content: - Contains a Base64-encoded string 11. Decoded String: - Contains sensitive information, such as configuration file paths and database connection settings 12. Impact: - Exposure of Sensitive Information: Reading arbitrary files may lead to data leakage, such as configuration files, API keys, or database passwords. - Privilege Escalation: Attackers may read files containing privileged information, enabling privilege escalation. - Server Compromise: Access to SSH keys, private key certificates, or system configuration files may result in full server compromise. - User Data Leakage: Reading arbitrary files may allow attackers to access user data, such as stored passwords, session tokens, or private information, violating privacy regulations (e.g., GDPR). This information provides a detailed overview of the vulnerability’s nature, impact, and remediation, helping developers understand and address the issue.

Goal Reached Thanks to every supporter — we hit 100%!

GHSA-cw6g-qmjq-6w2w: Arbitrary File Read via Email Template Abuse with PoC

More from this source