x/vulndb: potential Go vuln in github.com/owncast/owncast: CVE-2024-31450

[GoVulnBot]

CVE-2024-31450 references github.com/owncast/owncast, which may be a Go module.

Description:
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory. This vulnerability is fixed in 0.1.3.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-31450
• JSON: https://github.com/CVEProject/cvelist/tree/26d6198eec39a7594dbc3b669a827a74e527b58e/2024/31xxx/CVE-2024-31450.json
• advisory: https://securitylab.github.com/advisories/GHSL-2023-277_Owncast/
• fix: owncast/owncast@1b14800
• web: https://github.com/owncast/owncast/blob/v0.1.2/controllers/admin/emoji.go#L63
• web: https://github.com/owncast/owncast/releases/tag/v0.1.3
• Imported by: https://pkg.go.dev/github.com/owncast/owncast?tab=importedby

Cross references:

• Module github.com/owncast/owncast appears in issue x/vulndb: potential Go vuln in github.com/owncast/owncast: CVE-2021-39183 #291 EFFECTIVELY_PRIVATE
• Module github.com/owncast/owncast appears in issue x/vulndb: potential Go vuln in github.com/owncast/owncast: GHSA-cvh4-cjc9-84qm #1138 EFFECTIVELY_PRIVATE
• Module github.com/owncast/owncast appears in issue x/vulndb: potential Go vuln in github.com/owncast/owncast: CVE-2023-46480 #2354 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/owncast/owncast
      vulnerable_at: 0.1.3
      packages:
        - package: owncast
summary: CVE-2024-31450 in github.com/owncast/owncast
cves:
    - CVE-2024-31450
references:
    - advisory: https://securitylab.github.com/advisories/GHSL-2023-277_Owncast/
    - fix: https://github.com/owncast/owncast/commit/1b14800c7d7f54be14ed4d130bfe7f480645076e
    - web: https://github.com/owncast/owncast/blob/v0.1.2/controllers/admin/emoji.go#L63
    - web: https://github.com/owncast/owncast/releases/tag/v0.1.3
source:
    id: CVE-2024-31450

[gopherbot]

Change https://go.dev/cl/586484 mentions this issue: data/reports: add 73 unreviewed reports

[gopherbot]

Change https://go.dev/cl/590039 mentions this issue: data/reports: add 51 reports

[gopherbot]

Change https://go.dev/cl/606359 mentions this issue: data/reports: regenerate 50 reports