GHSA-8jxr-mccc-mwg8

OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)

Source: GitHub Advisory Database (reviewed) High CVE-2024-46977

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	openc3	< 5.19.0	5.19.0
PyPI	openc3	< 5.19.0	5.19.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary A path traversal vulnerability inside of `LocalMode`'s `open_local_file` method allows an authenticated user with adequate permissions to download any `.txt` via the `ScreensController#show` on the web server COSMOS is running on (depending on the file permissions). Note: This CVE affects all OpenC3 COSMOS Editions ### Impact This issue may lead to Information Disclosure.

References

External links from the advisory. They lead to third-party sites.

https://github.com/OpenC3/cosmos/security/advisories/GHSA-8jxr-mccc-mwg8 web
https://nvd.nist.gov/vuln/detail/CVE-2024-46977 advisory
https://github.com/OpenC3/cosmos/commit/a34e61aea5a465f0ab3e57d833ae7ff4cafd710b web
https://github.com/OpenC3/cosmos package
https://github.com/pypa/advisory-database/tree/main/vulns/openc3/PYSEC-2024-101.yaml web
https://rubysec.com/advisories/CVE-2024-46977 web
https://securitylab.github.com/advisories/GHSL-2024-127_GHSL-2024-129_OpenC3_COSMOS advisory