Assemblyline Service Client Path Traversal Arbitrary File Write Vulnerability

Critical Vulnerability Information Vulnerability Name Arbitrary Write through path traversal in Client code Severity CVSS v3.1 Base Score: 10.0 / 10 Attack Vector: Network Attack Complexity: Low Required Privileges: None User Interaction: None Scope: Changed Confidentiality: None Integrity: High Availability: High Affected Versions Affected Versions: <4.6.1.dev138, <4.6.0.stable11 Fixed Versions: 4.6.1.dev138+ Vulnerability Description Path traversal → Arbitrary file write in Assemblyline Service Client. Summary The Assemblyline service client ( ) accepts SHA-256 values returned by the service server and directly uses them as local filenames. No validation or sanitization is performed. A malicious or compromised server can return path traversal payloads such as , forcing the client to write downloaded bytes to arbitrary locations on the disk. Technical Details Vulnerable Code Location: in Vulnerable Line: Root Cause: The sha256 string, directly obtained from the service server's JSON response, is used as a filename without any validation or sanitization. Exploitation Flow: 1. Attacker (service server) returns HTTP 200 for 2. Client writes response body to 3. Achieves arbitrary file write (if file is executable, code execution is possible) Impact Integrity: Overwrites any file writable by the service UID (typically root). Availability: Corrupts critical files or exhausts disk space. Code Execution: Deletes cron jobs, systemd units, or overwrites binaries. Mitigation / Fix

Goal Reached Thanks to every supporter — we hit 100%!

Assemblyline Service Client Path Traversal Arbitrary File Write Vulnerability

More from this source