CVE-2024-7957: Arbitrary File Overwrite in danswer-ai/danswer
An arbitrary file overwrite vulnerability exists in the ZulipConnector of danswer-ai/danswer, affecting the latest version. The vulnerability arises from the loadcredentials method, where user-controlled input for realmname and zuliprccontent is used to construct file paths and write file contents. This allows attackers to overwrite or create arbitrary files if a zuliprc- directory already exists in the temporary directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7957?
CVE-2024-7957 is classified as a critical severity vulnerability due to its potential for arbitrary file overwriting.
How do I fix CVE-2024-7957?
To fix CVE-2024-7957, ensure input validation is implemented for user-controlled parameters in the load_credentials method to prevent unauthorized file path construction.
What systems are affected by CVE-2024-7957?
CVE-2024-7957 affects the latest version of the Danswer AI software from danswer-ai.
What type of vulnerability is CVE-2024-7957?
CVE-2024-7957 is an arbitrary file overwrite vulnerability.
Is there a known exploit for CVE-2024-7957?
As of now, there is no publicly reported exploit specifically for CVE-2024-7957.