Description
GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser, triggering os.RemoveAll on directories outside the data directory.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sea-team | GoFound | ≤ 1.4.1 | — |
References
- https://github.com/sea-team/gofound/issues/101 issue-tracking
- https://vul.yulun.ac.cn/20261102/gofound/ exploit
- https://github.com/sea-team/gofound/blob/v1.4.1/searcher/container.go technical-description
- https://github.com/sea-team/gofound/blob/v1.4.1/searcher/engine.go technical-description
- VulnCheck Advisory: GoFound through 1.4.1 Path Traversal via database parameter in /api/db/drop third-party-advisory