CVE-2022-36065

GrowthBook open-source self-hosted platform: Account registration and code execution via file uploads

• CVSS 7.5
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Local

GrowthBook is an open-source platform for feature flagging and A/B testing. With some self-hosted configurations in versions prior to 2022-08-29, attackers can register new accounts and upload files to arbitrary directories within the container. If the attacker uploads a Python script to the right location, they can execute arbitrary code within the container. To be affected, ALL of the following must be true: Self-hosted deployment (GrowthBook Cloud is unaffected); using local file uploads (as opposed to S3 or Google Cloud Storage); NODE_ENV set to a non-production value and JWT_SECRET set to an easily guessable string like `dev`. This issue is patched in commit 1a5edff8786d141161bf880c2fd9ccbe2850a264 (2022-08-29). As a workaround, set `JWT_SECRET` environment variable to a long random string. This will stop arbitrary file uploads, but the only way to stop attackers from registering accounts is by updating to the latest build.

CVE

CVE-2022-36065

CWE

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

7.5

Published

2022-09-06

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Direct Object References (IDOR)

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to GrowthBook version with commit 1a5edff8786d141161bf880c2fd9ccbe2850a264 (2022-08-29) or newer.

import os

JWT_SECRET = 'dev'
NODE_ENV = 'development'

def upload_file(file):
    upload_dir = '/uploads/'
    file_path = os.path.join(upload_dir, file.filename)

    file.save(file_path)

import os
from werkzeug.utils import secure_filename

JWT_SECRET = 'dev'
NODE_ENV = 'development'
UPLOAD_DIR = '/uploads/'
ALLOWED_EXTENSIONS = {'png', 'jpg', 'jpeg', 'gif', 'pdf'}
MAX_FILE_SIZE_MB = 5

def allowed_file(filename):
    return '.' in filename and \
           filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS

def upload_file(file):
    if not allowed_file(file.filename):
        raise ValueError("File type not allowed")

    file.seek(0, os.SEEK_END)
    file_length = file.tell()
    file.seek(0)

    if file_length > MAX_FILE_SIZE_MB * 1024 * 1024:
        raise ValueError("File size exceeds maximum limit")

    filename = secure_filename(file.filename)
    file_path = os.path.join(UPLOAD_DIR, filename)
    os.makedirs(UPLOAD_DIR, exist_ok=True)
    file.save(file_path)

@misc{vaitp:cve202236065,
  title        = {{GrowthBook open-source self-hosted platform: Account registration and code execution via file uploads}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-36065},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-36065/}}
}