CVE-2019-15032

Vulnerability

Pydio 6.0.8 (the community edition) mishandles error reporting when a directory is configured to allow unauthenticated uploads and the remote-upload feature is used with a crafted URL such as http://localhost:22. The application's error response reveals internal server paths and discloses the name of the user who created the target directory. The feature is accessible without authentication if the directory is publicly writable, as described in the advisory [2].

Exploitation

An attacker with network access to a Pydio instance triggers the vulnerability by using the remote-upload feature and supplying a URL pointing to an internal address (e.g., http://localhost:22). No authentication is required if the directory is open for unauthenticated uploads. The request causes Pydio to attempt connecting to the localhost endpoint, and the resulting error message improperly includes the server-side path and the username of the folder owner [2].

Impact

Successful exploitation leaks the filesystem path on the server and the username of the directory creator. This information can assist an attacker in performing targeted brute-force attacks on user passwords or in chaining the leak with other vulnerabilities (e.g., CVE-2019-15033) to escalate the attack [2].

Mitigation

The official fix is to upgrade to the latest stable version of Pydio. As of the disclosure date (September 2019), the vendor had not yet released a patched version specifically addressing this issue, but updating to the newest available release is recommended [2]. No workaround is described in the references.