Thruk Incorrect limitation of a pathname to a restricted directory (Path Traversal) (CWE-22)

Vulnerability

In Thruk versions before 3.12, the web monitoring application includes a file upload form for setting dashboard backgrounds. The form does not sanitize user-supplied folder paths, allowing path traversal sequences (e.g., ../). When a user is logged in, the upload function constructs the target path by concatenating a base usercontent_folder with the user-provided location parameter without validation. By manipulating the location to include ../ sequences, an attacker can direct the uploaded file to any directory for which the web server process has write permissions. The vulnerability is fixed in version 3.12 [1][2].

Exploitation

An attacker needs only a valid user account on the Thruk instance (any privilege level). After logging in, the attacker navigates to the dashboard background upload area, intercepts the request, and modifies the folder path parameter (e.g., to backgrounds/../../../../tmp/). The server then writes the uploaded file to the attacker-specified path, such as /tmp/ on a GNU/Linux system. No additional authentication or user interaction beyond the initial login is required [1].

Impact

Successful exploitation allows the attacker to arbitrarily write files to the server filesystem. This can lead to overwriting existing application resources (defacing the site), filling the disk (causing denial of service), or uploading a malicious script (e.g., a webshell) that permits remote command execution with the privileges of the web server process. The vulnerability primarily threatens integrity and availability, and can escalate to complete compromise [1].

Mitigation

The vulnerability is fixed in Thruk version 3.12, released on 2024-01-29. The patch [2] uses Cwd::abs_path to resolve the final path and checks that it remains within the intended usercontent_folder. For unpatched instances, ensure the web server user has minimal write permissions and monitor file upload logs for suspicious path sequences. No workaround other than upgrading is documented in the available references. The CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of publication [1].