CVE-2022-39345 (GCVE-0-2022-39345)
Vulnerability from cvelistv5 – Published: 2022-10-25 00:00 – Updated: 2025-04-22 17:17
VLAI
EPSS
VEX
Title
Gin-vue-admin arbitrary file upload vulnerability caused by path traversal
Summary
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-22 15:36 UTC
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| flipped-aurora | gin-vue-admin |
Affected:
< 2.5.4
|
guessed |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:00:44.117Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-7gc4-r5jr-9hxv"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/issues/1263"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/pull/1264"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-39345",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T15:36:37.785322Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T17:17:16.782Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "gin-vue-admin",
"vendor": "flipped-aurora",
"versions": [
{
"status": "affected",
"version": "\u003c 2.5.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23: Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-25T00:00:00.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"url": "https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-7gc4-r5jr-9hxv"
},
{
"url": "https://github.com/flipped-aurora/gin-vue-admin/issues/1263"
},
{
"url": "https://github.com/flipped-aurora/gin-vue-admin/pull/1264"
},
{
"url": "https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go"
}
],
"source": {
"advisory": "GHSA-7gc4-r5jr-9hxv",
"discovery": "UNKNOWN"
},
"title": "Gin-vue-admin arbitrary file upload vulnerability caused by path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-39345",
"datePublished": "2022-10-25T00:00:00.000Z",
"dateReserved": "2022-09-02T00:00:00.000Z",
"dateUpdated": "2025-04-22T17:17:16.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2022-39345",
"date": "2026-09-22",
"epss": "0.01412",
"percentile": "0.7152"
},
"fkie_nvd": {
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gin-vue-admin_project:gin-vue-admin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "86B452EF-D11A-48EC-9D1F-29C445C6B3B6",
"versionEndExcluding": "2.5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version."
},
{
"lang": "es",
"value": "Gin-vue-admin es un sistema de administraci\u00f3n de bambalinas basado en vue y gin, que separa la parte delantera y la trasera de la pila completa. Gin-vue-admin versiones anteriores a 2.5.4 es vulnerable a un salto de ruta, que conlleva a vulnerabilidades de descarga de archivos. La versi\u00f3n 2.5.4 contiene un parche para este problema. No se presentan mitigaciones aparte de actualizar a una versi\u00f3n parcheada"
}
],
"id": "CVE-2022-39345",
"lastModified": "2024-11-21T07:18:04.983",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-10-25T17:15:56.407",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go"
},
{
"source": "security-advisories@github.com",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/issues/1263"
},
{
"source": "security-advisories@github.com",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/pull/1264"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-7gc4-r5jr-9hxv"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/issues/1263"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/pull/1264"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-7gc4-r5jr-9hxv"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
},
{
"lang": "en",
"value": "CWE-23"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "gin-vue-admin",
"vendor": "flipped-aurora",
"versions": [
{
"status": "affected",
"version": "\u003c 2.5.4"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gin-vue-admin_project:gin-vue-admin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "86B452EF-D11A-48EC-9D1F-29C445C6B3B6",
"versionEndExcluding": "2.5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version."
},
{
"lang": "es",
"value": "Gin-vue-admin es un sistema de administraci\u00f3n de bambalinas basado en vue y gin, que separa la parte delantera y la trasera de la pila completa. Gin-vue-admin versiones anteriores a 2.5.4 es vulnerable a un salto de ruta, que conlleva a vulnerabilidades de descarga de archivos. La versi\u00f3n 2.5.4 contiene un parche para este problema. No se presentan mitigaciones aparte de actualizar a una versi\u00f3n parcheada"
}
],
"id": "CVE-2022-39345",
"lastModified": "2026-06-17T04:58:11.013",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-39345",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T15:36:37.785322Z",
"version": "2.0.3"
}
}
]
},
"published": "2022-10-25T17:15:56.407",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go"
},
{
"source": "security-advisories@github.com",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/issues/1263"
},
{
"source": "security-advisories@github.com",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/pull/1264"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-7gc4-r5jr-9hxv"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/issues/1263"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/pull/1264"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-7gc4-r5jr-9hxv"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
},
{
"lang": "en",
"value": "CWE-23"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2025-05-29T03:06:20+00:00",
"cve": "CVE-2022-39345",
"id": "CVE-2022-39345",
"initial_release_date": "2022-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "Gin-vue-admin arbitrary file upload vulnerability caused by path traversal",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-39345.json",
"version": "3"
}
}
}
FKIE_CVE-2022-39345
Vulnerability from fkie_nvd - Published: 2022-10-25 17:15 - Updated: 2026-06-17 04:58
Severity
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/
Summary
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| gin-vue-admin_project | gin-vue-admin | * |
{
"affected": [
{
"affectedData": [
{
"product": "gin-vue-admin",
"vendor": "flipped-aurora",
"versions": [
{
"status": "affected",
"version": "\u003c 2.5.4"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gin-vue-admin_project:gin-vue-admin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "86B452EF-D11A-48EC-9D1F-29C445C6B3B6",
"versionEndExcluding": "2.5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version."
},
{
"lang": "es",
"value": "Gin-vue-admin es un sistema de administraci\u00f3n de bambalinas basado en vue y gin, que separa la parte delantera y la trasera de la pila completa. Gin-vue-admin versiones anteriores a 2.5.4 es vulnerable a un salto de ruta, que conlleva a vulnerabilidades de descarga de archivos. La versi\u00f3n 2.5.4 contiene un parche para este problema. No se presentan mitigaciones aparte de actualizar a una versi\u00f3n parcheada"
}
],
"id": "CVE-2022-39345",
"lastModified": "2026-06-17T04:58:11.013",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-39345",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T15:36:37.785322Z",
"version": "2.0.3"
}
}
]
},
"published": "2022-10-25T17:15:56.407",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go"
},
{
"source": "security-advisories@github.com",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/issues/1263"
},
{
"source": "security-advisories@github.com",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/pull/1264"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-7gc4-r5jr-9hxv"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/issues/1263"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/pull/1264"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-7gc4-r5jr-9hxv"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
},
{
"lang": "en",
"value": "CWE-23"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-7GC4-R5JR-9HXV
Vulnerability from github – Published: 2022-10-25 21:02 – Updated: 2022-10-27 18:38
VLAI
Summary
Gin-vue-admin subject to Remote Code Execution via file upload vulnerability
Details
Impact
Gin-vue-admin < 2.5.4 has File upload vulnerabilities。 File upload vulnerabilities are when a web server allows users to upload files to its filesystem without sufficiently validating things like their name, type, contents, or size. Failing to properly enforce restrictions on these could mean that even a basic image upload function can be used to upload arbitrary and potentially dangerous files instead. This could even include server-side script files that enable remote code execution.
Patches
https://github.com/flipped-aurora/gin-vue-admin/pull/1264
Workarounds
https://github.com/flipped-aurora/gin-vue-admin/pull/1264
References
1263
For more information
The plugin installation function of Gin-Vue-Admin allows users to download zip packages from the plugin market and upload them for installation. This function has an arbitrary file upload vulnerability. A malicious attacker can upload a constructed zip package to traverse the directory and upload or overwrite arbitrary files on the server side.
The affected code https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go line 880 called the utils.Unzip method
paths, err := utils.Unzip(GVAPLUGPINATH+file.Filename, GVAPLUGPINATH)
paths = filterFile(paths)
var webIndex = -1
var serverIndex = -1
for i := range paths {
paths[i] = filepath.ToSlash(paths[i])
pathArr := strings.Split(paths[i], "/")
ln := len(pathArr)
if ln < 2 {
continue
}
if pathArr[ln-2] == "server" && pathArr[ln-1] == "plugin" {
serverIndex = i
}
if pathArr[ln-2] == "web" && pathArr[ln-1] == "plugin" {
webIndex = i
}
}
if webIndex == -1 && serverIndex == -1 {
zap.L().Error("非标准插件，请按照文档自动迁移使用")
return webIndex, serverIndex, errors.New("非标准插件，请按照文档自动迁移使用")
}
...
The https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/utils/zip.go code defines the utils.Unzip method
//解压
func Unzip(zipFile string, destDir string) ([]string, error) {
zipReader, err := zip.OpenReader(zipFile)
var paths []string
if err != nil {
return []string{}, err
}
defer zipReader.Close()
for _, f := range zipReader.File {
fpath := filepath.Join(destDir, f.Name)
paths = append(paths, fpath)
if f.FileInfo().IsDir() {
os.MkdirAll(fpath, os.ModePerm)
...
It can be analyzed that after uploading a zip compressed file, the Unzip method will be called to decompress the compressed file, and then judge whether the compressed file contains the fixed directory structure of server, web, and plugin.
Whether the zip file is correct or not, it will be decompressed first. If the directory does not exist, it will be created automatically. Therefore, malicious zip packages can be constructed, and directory traversal can be performed during automatic decompression to upload or overwrite any file.
Use the Zip Slip vulnerability to construct a malicious zip package with ../../../../ filenames, and upload the malicious zip package to trigger the vulnerability.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/flipped-aurora/gin-vue-admin/server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-39345"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2022-10-25T21:02:23Z",
"nvd_published_at": "2022-10-25T17:15:00Z",
"severity": "CRITICAL"
},
"details": "### Impact\nGin-vue-admin \u003c 2.5.4 has File upload vulnerabilities\u3002\nFile upload vulnerabilities are when a web server allows users to upload files to its filesystem without sufficiently validating things like their name, type, contents, or size. Failing to properly enforce restrictions on these could mean that even a basic image upload function can be used to upload arbitrary and potentially dangerous files instead. This could even include server-side script files that enable remote code execution.\n\n### Patches\n\nhttps://github.com/flipped-aurora/gin-vue-admin/pull/1264\n\n### Workarounds\n\nhttps://github.com/flipped-aurora/gin-vue-admin/pull/1264\n### References\n\n#1263 \n\n### For more information\nThe plugin installation function of Gin-Vue-Admin allows users to download zip packages from the plugin market and upload them for installation. This function has an arbitrary file upload vulnerability. A malicious attacker can upload a constructed zip package to traverse the directory and upload or overwrite arbitrary files on the server side.\n\nThe affected code https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go line 880 called the `utils.Unzip` method\n\n```\npaths, err := utils.Unzip(GVAPLUGPINATH+file.Filename, GVAPLUGPINATH)\n\tpaths = filterFile(paths)\n\tvar webIndex = -1\n\tvar serverIndex = -1\n\tfor i := range paths {\n\t\tpaths[i] = filepath.ToSlash(paths[i])\n\t\tpathArr := strings.Split(paths[i], \"/\")\n\t\tln := len(pathArr)\n\t\tif ln \u003c 2 {\n\t\t\tcontinue\n\t\t}\n\t\tif pathArr[ln-2] == \"server\" \u0026\u0026 pathArr[ln-1] == \"plugin\" {\n\t\t\tserverIndex = i\n\t\t}\n\t\tif pathArr[ln-2] == \"web\" \u0026\u0026 pathArr[ln-1] == \"plugin\" {\n\t\t\twebIndex = i\n\t\t}\n\t}\n\tif webIndex == -1 \u0026\u0026 serverIndex == -1 {\n\t\tzap.L().Error(\"\u975e\u6807\u51c6\u63d2\u4ef6\uff0c\u8bf7\u6309\u7167\u6587\u6863\u81ea\u52a8\u8fc1\u79fb\u4f7f\u7528\")\n\t\treturn webIndex, serverIndex, errors.New(\"\u975e\u6807\u51c6\u63d2\u4ef6\uff0c\u8bf7\u6309\u7167\u6587\u6863\u81ea\u52a8\u8fc1\u79fb\u4f7f\u7528\")\n\t}\n...\n```\nThe https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/utils/zip.go code defines the `utils.Unzip` method\n```\n//\u89e3\u538b\nfunc Unzip(zipFile string, destDir string) ([]string, error) {\n\tzipReader, err := zip.OpenReader(zipFile)\n\tvar paths []string\n\tif err != nil {\n\t\treturn []string{}, err\n\t}\n\tdefer zipReader.Close()\n\n\tfor _, f := range zipReader.File {\n\t\tfpath := filepath.Join(destDir, f.Name)\n\t\tpaths = append(paths, fpath)\n\t\tif f.FileInfo().IsDir() {\n\t\t\tos.MkdirAll(fpath, os.ModePerm)\n...\n```\nIt can be analyzed that after uploading a zip compressed file, the `Unzip` method will be called to decompress the compressed file, and then judge whether the compressed file contains the fixed directory structure of server, web, and plugin.\n\nWhether the zip file is correct or not, it will be decompressed first. If the directory does not exist, it will be created automatically. Therefore, malicious zip packages can be constructed, and directory traversal can be performed during automatic decompression to upload or overwrite any file.\n\nUse the Zip Slip vulnerability to construct a malicious zip package with `../../../../` filenames, and upload the malicious zip package to trigger the vulnerability.\n\n\n\n",
"id": "GHSA-7gc4-r5jr-9hxv",
"modified": "2022-10-27T18:38:32Z",
"published": "2022-10-25T21:02:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-7gc4-r5jr-9hxv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39345"
},
{
"type": "WEB",
"url": "https://github.com/flipped-aurora/gin-vue-admin/issues/1263"
},
{
"type": "WEB",
"url": "https://github.com/flipped-aurora/gin-vue-admin/pull/1264"
},
{
"type": "PACKAGE",
"url": "https://github.com/flipped-aurora/gin-vue-admin"
},
{
"type": "WEB",
"url": "https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Gin-vue-admin subject to Remote Code Execution via file upload vulnerability"
}
GSD-2022-39345
Vulnerability from gsd - Updated: 2023-12-13 01:19Details
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2022-39345",
"description": "Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version.",
"id": "GSD-2022-39345"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2022-39345"
],
"details": "Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version.",
"id": "GSD-2022-39345",
"modified": "2023-12-13T01:19:20.412227Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-39345",
"STATE": "PUBLIC",
"TITLE": "Gin-vue-admin arbitrary file upload vulnerability caused by path traversal"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "gin-vue-admin",
"version": {
"version_data": [
{
"version_value": "\u003c 2.5.4"
}
]
}
}
]
},
"vendor_name": "flipped-aurora"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-23: Relative Path Traversal"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-7gc4-r5jr-9hxv",
"refsource": "CONFIRM",
"url": "https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-7gc4-r5jr-9hxv"
},
{
"name": "https://github.com/flipped-aurora/gin-vue-admin/issues/1263",
"refsource": "MISC",
"url": "https://github.com/flipped-aurora/gin-vue-admin/issues/1263"
},
{
"name": "https://github.com/flipped-aurora/gin-vue-admin/pull/1264",
"refsource": "MISC",
"url": "https://github.com/flipped-aurora/gin-vue-admin/pull/1264"
},
{
"name": "https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go",
"refsource": "MISC",
"url": "https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go"
}
]
},
"source": {
"advisory": "GHSA-7gc4-r5jr-9hxv",
"discovery": "UNKNOWN"
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003cv2.5.4",
"affected_versions": "All versions before 2.5.4",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-22",
"CWE-78",
"CWE-937"
],
"date": "2022-10-25",
"description": "Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version.",
"fixed_versions": [
"v2.5.4"
],
"identifier": "CVE-2022-39345",
"identifiers": [
"GHSA-7gc4-r5jr-9hxv",
"CVE-2022-39345"
],
"not_impacted": "All versions starting from 2.5.4",
"package_slug": "go/github.com/flipped-aurora/gin-vue-admin/server",
"pubdate": "2022-10-25",
"solution": "Upgrade to version 2.5.4 or above.",
"title": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"urls": [
"https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-7gc4-r5jr-9hxv",
"https://nvd.nist.gov/vuln/detail/CVE-2022-39345",
"https://github.com/flipped-aurora/gin-vue-admin/issues/1263",
"https://github.com/flipped-aurora/gin-vue-admin/pull/1264",
"https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go",
"https://github.com/advisories/GHSA-7gc4-r5jr-9hxv"
],
"uuid": "7ae3a134-5416-496e-9f68-155185c2a75a",
"versions": [
{
"commit": {
"sha": "1e9cdcd5a67e594821ec6738073a89015fffeb54",
"tags": [
"v2.5.4"
],
"timestamp": "20220926075728"
},
"number": "v2.5.4"
}
]
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:gin-vue-admin_project:gin-vue-admin:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.5.4",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-39345"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-7gc4-r5jr-9hxv",
"refsource": "CONFIRM",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-7gc4-r5jr-9hxv"
},
{
"name": "https://github.com/flipped-aurora/gin-vue-admin/pull/1264",
"refsource": "MISC",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/pull/1264"
},
{
"name": "https://github.com/flipped-aurora/gin-vue-admin/issues/1263",
"refsource": "MISC",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/issues/1263"
},
{
"name": "https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go",
"refsource": "MISC",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go"
}
]
}
},
"impact": {
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
},
"lastModifiedDate": "2022-10-26T00:54Z",
"publishedDate": "2022-10-25T17:15Z"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…