--- cve: "CVE-2022-24900" severity: "CRITICAL" cvss: 9.9 epss: "8.4%" vendor: "onlaj" kev: false exploited: false published: "2022-04-29 13:50:11" tags: [cve, security, critical] source: tsecurity.de CVE-Dossier exported: "2026-10-21T11:37:14+02:00" --- # CVE-2022-24900 > 9.9 CRITICAL · 🧪 PoC ## Beschreibung Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The `os.path.join` call is unsafe for use with untrusted input. When the `os.path.join` call encounters an absolute path, it ignores all the parameters it has encountered till that point and starts working with the new absolute path. Since the "malicious" parameter represents an absolute path, the result of `os.path.join` ignores the static directory completely. Hence, untrusted input is passed via the `os.path.join` call to `flask.send_file` can lead to path traversal attacks. A patch with a fix is available on the `master` branch of the GitHub repository. This can also be fixed by preventing flow of untrusted data to the vulnerable `send_file` function. In case the application logic necessiates this behaviour, one can either use the `flask.safe_join` to join untrusted paths or replace `flask.send_file` calls with `flask.send_from_directory` calls. ## CNA-Record (Kanon, cvelistV5) - CNA: **GitHub_M** - State: PUBLISHED - Stand: 2025-04-22 18:02:15 - CNA-CVSS: **9.9** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L`) ## CISA-Anreicherung (vulnrichment/ADP) - CISA-SSVC (Coordinator, v2.0.3): - Exploitation: **poc** - Automatable: **yes** - Technical Impact: **partial** ## CVSS-Vektor ``` CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC Komplexität | Gering | bad | | PR Privilegien | Keine | bad | | UI Interaktion | Keine | bad | | S Scope | Verändert | bad | | C Vertraulichkeit | Hoch | bad | | I Integrität | Gering | warn | | A Verfügbarkeit | Gering | warn | ## Schwachstellen-Klasse - **CWE-22** — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. - **CWE-73** — External Control of File Name or Path The product allows user input to control or influence paths or file names that are used in filesystem operations. ## Angriffsmuster (CAPEC) - [CAPEC-64 — Using Slashes and URL Encoding Combined to Bypass Validation Logic](https://capec.mitre.org/data/definitions/64.html) _(Severity: High)_ - [CAPEC-76 — Manipulating Web Input to File System Calls](https://capec.mitre.org/data/definitions/76.html) _(Severity: Very High)_ - [CAPEC-78 — Using Escaped Slashes in Alternate Encoding](https://capec.mitre.org/data/definitions/78.html) _(Severity: High)_ - [CAPEC-79 — Using Slashes in Alternate Encoding](https://capec.mitre.org/data/definitions/79.html) _(Severity: High)_ - [CAPEC-126 — Path Traversal](https://capec.mitre.org/data/definitions/126.html) _(Severity: Very High)_ ## Patch verfügbar (OSV) - 3f10602323cd8184e1c69a76b815655597bf0ee5 (Commit) ## Referenzen - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2022-24900/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_