An arbitrary file overwrite vulnerability exists in the ZulipConnector of danswer-ai/danswer, affecting the latest version. The vulnerability arises from the load_credentials method, where user-controlled input for realm_name and zuliprc_content is used to construct file paths and write file contents. This allows attackers to overwrite or create arbitrary files if a zuliprc- directory already exists in the temporary directory.
The vulnerability lies in the load_credentials method, which accepts realm_name and zuliprc_content values from the user and uses them directly to construct file paths and save their contents. The lack of proper sanitization of this data (CWE-29: path traversal) allows an attacker to escape the intended target directory. The attack is possible when a directory named zuliprc- already exists in the temporary directory, which allows overwriting or creating arbitrary files in the server's file system.
An unauthenticated attacker can overwrite or create arbitrary files on the server, which can lead to system integrity violations, service disruption (denial of service), or potential code execution through replacement of critical configuration or binary files.
Apply patches available from the vendor according to the references (https://huntr.com/bounties/21e9b909-036c-4544-ad35-6a5117836275). Additionally, it is recommended to restrict access to ZulipConnector configuration endpoints exclusively to trusted users and to monitor write operations in temporary directories.
The latest version of danswer-ai/danswer (the exact version was not specified in the description — details in the vendor references)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H