CVE-2019-13915

Vulnerability

Overview

b3log Wide before version 1.6.0 contains three distinct attack vectors that allow an attacker to access arbitrary files on the server. The root cause is insufficient validation of user-supplied code and archive contents, combined with the ability to execute code and import ZIP or Git repositories [1][2].

Exploitation

Details

First, an attacker can write arbitrary code in the editor, compile it, and run it approximately three times to read any file on the system. Second, an attacker can create a symbolic link (symlink) and place it into a ZIP archive; when Wide unzips the archive, it follows the symlink, granting read and potentially write access to the target file. Third, importing a Git repository that contains a symlink similarly leads to read and write access to the symlink target [2].

Impact

Successful exploitation allows an attacker to read sensitive files (e.g., configuration, credentials) and, depending on file permissions, write to arbitrary files. This could lead to privilege escalation, data exfiltration, or remote code execution in the context of the Wide application.

Mitigation

The vulnerabilities are fixed in b3log Wide version 1.6.0. Users should upgrade to this version or later. No workarounds are documented; upgrading is the recommended action [1][2].