CVE-2026-92604
Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlled JSON content to filesystem paths. Attackers can supply path traversal sequences in the uploaded document's _id field to escape the intended directory and write files with .json extension to arbitrary locations as root.
弱点类型
Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlled JSON content to filesystem paths. Attackers can supply path traversal sequences in the uploaded document's _id field to escape the intended directory and write files with .json extension to arbitrary locations as root.
参考链接
- https://github.com/StamusNetworks/scirius
- https://github.com/StamusNetworks/scirius/blob/3bb49d383f4801b79e6356f9de9f25806afe0311/suricata/rest_api.py#L105-L113
- https://github.com/geo-chen/oss/blob/main/scirius.md
- https://www.vulncheck.com/advisories/scirius-through-3.8.0-arbitrary-file-write-via-pcap-upload
- https://github.com/geo-chen/oss/blob/main/scirius.md