Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in the Gramps Web API could allow an authenticated user to write arbitrary files on the server. This is because a crafted ZIP file containing specially named files can bypass security checks during the import of media archives. This could lead to significant system compromise if exploited.
- Server-side file overwrite risk.
- Requires authenticated access.
- Impacts data integrity and availability.
Attack Path
How an attacker could exploit the issue
An authenticated owner-level user can exploit this vulnerability by uploading a specially crafted ZIP archive. This archive would contain files with names designed to traverse directories outside the intended extraction location, allowing them to overwrite or place arbitrary files on the server.
- Requires authenticated owner privileges.
- Targets the media archive import.
- Upload a malicious ZIP archive.
Live Threat
Current exploitation, exposure, and threat context
Attackers may find this vulnerability less appealing due to its requirement for authenticated owner-level privileges and the niche nature of the Gramps Web API, which is often self-hosted for personal use rather than widely exposed internet-facing infrastructure. While it allows for arbitrary file write, the attack chain is more complex than typical unauthenticated vulnerabilities.
- No public exploit code observed.
- Not listed as actively exploited.
- Fix released relatively quickly.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching Gramps Web API to version 3.11.1 to address the path traversal vulnerability, which allows authenticated users to write arbitrary files. If immediate patching is not feasible, restrict access to the media archive import feature for owner-level users and monitor for suspicious file creation events.
- Patch to version 3.11.1.
- Restrict media import access.
- Monitor for unauthorized file writes.
