Summary
Impacket prior to version 0.9.23 is vulnerable to Path Traversal
Product
Impacket prior to 0.9.23
Impact
If the vulnerability is exploited, an attacker could write files to any location on the affected computer. This could be elevated to an RCE in a variety of ways depending on the environment and the operating system.
Steps to reproduce
- For a full and detailed reproduction see: Checkmarx Research Blogpost
Expected result:
Files should only be listed and written to the intended work directory.
Remediation
This issue was fixed in version 0.9.23 through the commit.
Credit
This issue was discovered and reported by Checkmarx Security Researcher
Omri Inbar.
