Lucene search

@huntr_aiVULNRICHMENT:CVE-2024-2221

HistoryApr 10, 2024 - 5:07 p.m.

CVE-2024-2221 Path Traversal and Arbitrary File Upload Vulnerability in qdrant/qdrant

2024-04-1017:07:59

CWE-434

@huntr_ai

github.com

cve-2024-2221

path traversal

file upload

qdrant/qdrant

remote code execution

unauthorized access

server malfunction

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.1

Confidence

Low

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

total

JSON

qdrant/qdrant is vulnerable to a path traversal and arbitrary file upload vulnerability via the /collections/{COLLECTION}/snapshots/upload endpoint, specifically through the snapshot parameter. This vulnerability allows attackers to upload and overwrite any file on the filesystem, leading to potential remote code execution. This issue affects the integrity and availability of the system, enabling unauthorized access and potentially causing the server to malfunction.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:qdrant:qdrant:*:*:*:*:*:*:*:*"
    ],
    "vendor": "qdrant",
    "product": "qdrant",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "1.8.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

github.com/qdrant/qdrant/commit/e6411907f0ecf3c2f8ba44ab704b9e4597d9705d

huntr.com/bounties/6be8d4e3-67e6-4660-a8db-04215a1cff3e

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.1

Confidence

Low

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

total

JSON

Related for VULNRICHMENT:CVE-2024-2221