Critical · published February 6, 2025
🚨 A path traversal vulnerability in WhoDB lets attackers waltz through the database directory and access ANY Sqlite3 database on the host system! 🔥 Think of WhoDB as a library that only allows you to check out books from a specific shelf. However, it forgot to lock the doors to the back rooms, allowing anyone to grab any book in the whole library without permission! 📚 An unauthenticated attacker could exploit this vulnerability to access confidential data from any Sqlite3 database on the machine, potentially exposing sensitive user information, credentials, or system configurations. This could lead to data breaches that are absolutely devastating for your organization!
Think of WhoDB as a library that only allows you to check out books from a specific shelf. However, it forgot to lock the doors to the back rooms, allowing anyone to grab any book in the whole library without permission! 📚 This vulnerability arises because WhoDB fails to validate the path of the database file, allowing attackers to use path traversal sequences (`../../`) to access databases outside the intended directory. It permits any database file on the system to be opened if an attacker can manipulate the user-controlled database file value.
An unauthenticated attacker could exploit this vulnerability to access confidential data from any Sqlite3 database on the machine, potentially exposing sensitive user information, credentials, or system configurations. This could lead to data breaches that are absolutely devastating for your organization! Upgrade to WhoDB version 0.45.0 immediately to close this critical vulnerability. Since no workarounds exist, patching is essential to protect your data. Review and audit any existing access controls to ensure they are properly configured after the update. You've got this! Follow these steps, and you'll have your WhoDB secured in no time. 🛡️