CVE-2023-35844

Vulnerability

The vulnerability exists in the Slack image endpoint and CSV file endpoint in Lightdash versions before 0.510.3. The server constructs file paths by concatenating user-supplied parameters (imageId or fileId) to the /tmp directory without proper sanitization, allowing directory traversal sequences like .. to escape the intended directory. Additionally, the endpoints do not enforce that the file extension matches the expected type (.png for images, .csv for CSV files). [1][2]

Exploitation

An attacker can send a crafted request to the /slack/image/:imageId or /api/v1/projects/.../csv/:fileId endpoints with a path traversal payload in the parameter, such as ../../etc/passwd. No authentication is required for the Slack image endpoint; the attacker simply needs network access to the Lightdash server. The server will serve the file if it exists, or return an error message that reveals the file path existence. [1]

Impact

Successful exploitation allows an attacker to read arbitrary files on the server filesystem, including sensitive configuration files, credentials, or other data. This leads to information disclosure. The attacker gains no code execution directly, but the leaked information could be used for further attacks. [1]

Mitigation

The fix was implemented in commit fcc808c and released in Lightdash version 0.510.3 on April 14, 2023. The fix adds checks to ensure the fileId starts with csv- and ends with .csv, and the imageId starts with slack-image and ends with .png. It also sanitizes the parameter by removing .. sequences. Users should upgrade to version 0.510.3 or later. No workaround is provided for older versions. [2][3][4]