CVE-2022-36065

GrowthBook is an open-source platform for feature flagging and A/B testing. With some self-hosted configurations in versions prior to 2022-08-29, attackers can register new accounts and upload files to arbitrary directories within the container. If the attacker uploads a Python script to the right location, they can execute arbitrary code within the container. To be affected, ALL of the following must be true: Self-hosted deployment (GrowthBook Cloud is unaffected); using local file uploads (as opposed to S3 or Google Cloud Storage); NODE_ENV set to a non-production value and JWT_SECRET set to an easily guessable string like `dev`. This issue is patched in commit 1a5edff8786d141161bf880c2fd9ccbe2850a264 (2022-08-29). As a workaround, set `JWT_SECRET` environment variable to a long random string. This will stop arbitrary file uploads, but the only way to stop attackers from registering accounts is by updating to the latest build.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/growthbook/growthbook/commit/1a5edff8786d141161bf880c2fd9ccbe2850a264	Patch Third Party Advisory
https://github.com/growthbook/growthbook/pull/487	Issue Tracking Mitigation Patch Third Party Advisory
https://github.com/growthbook/growthbook/security/advisories/GHSA-j24q-55xh-wm4r	Issue Tracking Mitigation Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:growthbook:growthbook:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-09-06 21:15

Updated : 2023-07-21 20:52

NVD link : CVE-2022-36065

Mitre link : CVE-2022-36065

CVE.ORG link : CVE-2022-36065

JSON object : View

Products Affected

growthbook

growthbook

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-24

Path Traversal: '../filedir'

{"id": "CVE-2022-36065", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2022-09-06T21:15:08.760", "references": [{"url": "https://github.com/growthbook/growthbook/commit/1a5edff8786d141161bf880c2fd9ccbe2850a264", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/growthbook/growthbook/pull/487", "tags": ["Issue Tracking", "Mitigation", "Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/growthbook/growthbook/security/advisories/GHSA-j24q-55xh-wm4r", "tags": ["Issue Tracking", "Mitigation", "Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-24"}]}], "descriptions": [{"lang": "en", "value": "GrowthBook is an open-source platform for feature flagging and A/B testing. With some self-hosted configurations in versions prior to 2022-08-29, attackers can register new accounts and upload files to arbitrary directories within the container. If the attacker uploads a Python script to the right location, they can execute arbitrary code within the container. To be affected, ALL of the following must be true: Self-hosted deployment (GrowthBook Cloud is unaffected); using local file uploads (as opposed to S3 or Google Cloud Storage); NODE_ENV set to a non-production value and JWT_SECRET set to an easily guessable string like `dev`. This issue is patched in commit 1a5edff8786d141161bf880c2fd9ccbe2850a264 (2022-08-29). As a workaround, set `JWT_SECRET` environment variable to a long random string. This will stop arbitrary file uploads, but the only way to stop attackers from registering accounts is by updating to the latest build."}, {"lang": "es", "value": "GrowthBook es una plataforma de c\u00f3digo abierto para el marcado de caracter\u00edsticas y las pruebas A/B. Con algunas configuraciones auto-alojadas en versiones anteriores al 29-08-2022, los atacantes pueden registrar nuevas cuentas y subir archivos a directorios arbitrarios dentro del contenedor. Si el atacante sube un script de Python a la ubicaci\u00f3n correcta, puede ejecutar c\u00f3digo arbitrario dentro del contenedor. Para ser afectado, TODO lo siguiente debe ser cierto: despliegue auto-alojado (GrowthBook Cloud no est\u00e1 afectado); el uso de cargas de archivos locales (en lugar de S3 o Google Cloud Storage); NODE_ENV establecido a un valor no de producci\u00f3n y JWT_SECRET establecido a una cadena f\u00e1cilmente adivinable como \"dev\". Este problema est\u00e1 parcheado en el commit 1a5edff8786d141161bf880c2fd9ccbe2850a264 (2022-08-29). Como mitigaci\u00f3n, establezca la variable de entorno \"JWT_SECRET\" a una cadena larga y aleatoria. Esto detendr\u00e1 la carga de archivos arbitrarios, pero la \u00fanica forma de evitar que los atacantes registren cuentas es actualizando a la \u00faltima versi\u00f3n.\n"}], "lastModified": "2023-07-21T20:52:53.347", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:growthbook:growthbook:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3749527E-1CFE-4D57-93C5-663AF209209C", "versionEndExcluding": "1.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}