Description
Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in the workspace field and subsequently use relative paths in the session file API to access any file readable by the WebUI process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nesquena | hermes-webui | < 0.51.44 | 0.51.44 |
References
- hermes-webui 0.51.44 Release Notes release-notes
- https://github.com/nesquena/hermes-webui/pull/2048 issue-tracking patch
- https://github.com/nesquena/hermes-webui/commit/f00cb74f776f22f02f5eb6b39dfb389f87cc7fd3 patch
- https://www.vulncheck.com/advisories/hermes-webui-path-traversal-via-session-import-endpoint third-party-advisory