[Security] Unauthenticated Path Traversal + IDOR Password Change (3 Vulnerabilities)

Security: Unauthenticated Path Traversal in Sync Endpoints (CVE Request)

Summary

Multiple path traversal vulnerabilities in Crawlab allow unauthenticated attackers to read arbitrary files on the server.

Vulnerabilities

V1: Unauthenticated Path Traversal (Critical - CVSS 9.1)

• Endpoint: GET /sync/:id/scan?path=, GET /sync/:id/download?path=
• Root Cause: controllers/sync_v2.go — sync endpoints registered under AnonymousGroup without path validation. filepath.Join() resolves .. traversal.
• Attack: No authentication required. path=../../../etc/passwd reads any file.

V2: Authenticated Arbitrary File Read/Write/Delete (High - CVSS 8.8)

• Endpoint: /spiders/:id/files/get, /spiders/:id/files/save, /spiders/:id/files
• Root Cause: fs/service_v2.go — no path validation in any FsServiceV2 methods.
• Attack: Authenticated user can read/write/delete arbitrary files via path traversal → RCE.

V3: IDOR Password Change (High - CVSS 8.1)

• Endpoint: POST /users/:id/change-password
• Root Cause: controllers/user_v2.go:47-73 — does not verify current user matches target user.
• Attack: Any authenticated user can change any other user's password (including admin) without knowing the old password.

Exploit Chain

1. GET /sync/x/scan?path=../../etc → Unauthenticated directory enumeration
2. GET /sync/x/download?path=../../etc/shadow → Sensitive file read
3. POST /spiders/x/files/save → Arbitrary file write → RCE (crontab/SSH key)

Discoverer

icysun & Yashon

Full report and PoC available upon request.