Vulnerability CVE-2024-28335
Published: 2024-03-27

Description:
Lektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates directory, if the victim's web browser accesses an untrusted website that uses JavaScript to send requests to localhost port 5000, and the web browser is running on the same machine as the "lektor server" command.

See advisories in our WLB2 database:
Topic
Author
Date
High
Lektor 3.3.10 Arbitrary File upload
kai6u
20.03.2024

Type:

CWE-434

 (Unrestricted Upload of File with Dangerous Type)

 References:
https://github.com/lektor/lektor/pull/1179/commits/8f38b9713d152622b69ff5e3b1e6a0d7bb7fa800
https://github.com/lektor/lektor/releases/tag/v3.3.11
https://cxsecurity.com/issue/WLB-2024030043
https://packetstormsecurity.com/files/177708/Lektor-Static-CMS-3.3.10-Arbitrary-File-Upload-Remote-Code-Execution.html
https://getlektor.com/docs/quickstart
https://brave.com/privacy-updates/27-localhost-permission/
Copyright 2024, cxsecurity.com

 

Back to Top