CVE-2024-49359
ZimaOS vulnerable to Directory Listing via Parameter Manipulation
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
ZimaOS vulnerable to Directory Listing via Parameter Manipulation
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http://<Zima_Server_IP:PORT>/v2_1/file` in ZimaOS is vulnerable to a directory traversal attack, allowing authenticated users to list the contents of any directory on the server. By manipulating the path parameter, attackers can access sensitive system directories such as `/etc`, potentially exposing critical configuration files and increasing the risk of further attacks. As of time of publication, no known patched versions are available.
Reserved 2024-10-14 | Published 2024-10-24 | Updated 2024-10-25 | Assigner GitHub_MCWE-552: Files or Directories Accessible to External Parties
github.com/...ZimaOS/security/advisories/GHSA-mwpw-fhrm-728x
Support options
