Description
CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated archives.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| coaidev | CoAI | ≤ 4.0.0 | — |
References
- https://hackmd.io/@hieuPenguinnn/coai-chatnio-generation-article-download-path-traversal third-party-advisory
- https://github.com/coaidev/coai/blob/v4.0.0/addition/generation/api.go#L19-L29 technical-description
- https://github.com/coaidev/coai/blob/v4.0.0/addition/article/api.go#L25-L35 technical-description
- VulnCheck Advisory: CoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints third-party-advisory