yu-ai-code-mother Unauthenticated Static File Read & Path Traversal (CVE-XXXX)

Vulnerability Key Information Summary Vulnerability Overview Vulnerability Name: yu-ai-code-mother Unauthenticated Static File Read + Path Traversal (File Read) Vulnerability Type: Missing Authentication + Path Traversal Description: In the open-source AI code generation platform (Spring Boot 3.5.3, embedded Tomcat 10.1), the static resource endpoint lacks authentication. Additionally, the user-controllable is directly concatenated into the preview root directory path without normalization or blacklist filtering, allowing anonymous attackers to read files located outside the preview root directory. Impact Scope Affected Component: within (com.yupi-yu-ai-code-app, Spring Boot 3.5.3 + JDK 21) Trigger Conditions: No authentication required (anonymous access) Impact: Anonymous attackers can read any file under the directory (generated user code / previews), and can read files outside the preview root directory via path traversal (which may include temporary files and sensitive data). The depth of traversal is determined by the embedded Tomcat 10.1 within the deployment container (it intercepts 3 levels of , resulting in a 404). After decoding/normalizing encoded variants, other containers or reverse proxies may expand the scope of impact. Remediation Add authentication to the static resource endpoint (e.g., add the annotation or implement ACP-based authentication). Perform path normalization and blacklist filtering on (e.g., using or a blacklist) to prevent traversal from escaping the preview root directory. Restrict the accessible path range to allow only files within the preview root directory. POC / Exploit Code Source (Vulnerability Entry Point) —— and are extracted from the URL, with no annotation (authentication is based on ACP and is entirely bypassed): Sink (Direct concatenation without Path.normalize / blacklist): Path Traversal Exploit Example (escaping the preview root to read external files): (Escape path: → , located outside the preview root)

Goal Reached Thanks to every supporter — we hit 100%!

yu-ai-code-mother Unauthenticated Static File Read & Path Traversal (CVE-XXXX)

More from this source