CVE-2024-55602: PwnDoc Path Traversal Vulnerability

CVE-2024-55602 Overview

PwnDoc is an open-source penetration test report generator used by security teams to produce client deliverables. CVE-2024-55602 is a path traversal vulnerability [CWE-22] in the template update and download functionality. An authenticated user can inject ../ sequences into the file extension property to read arbitrary files from the underlying host. The flaw exists in backend/src/routes/template.js, where the ext request parameter is written to disk and later resolved during template downloads without validation. Commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 patches the issue by rejecting invalid filename characters in the extension field.

Critical Impact
Any authenticated PwnDoc user with template management privileges can read arbitrary files on the server, including credentials, private keys, and report data belonging to other engagements.

Affected Products

PwnDoc versions prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6
pwndoc_project:pwndoc reporting backend
Deployments exposing the /api/templates routes to authenticated users

Discovery Timeline

2024-12-10 - CVE-2024-55602 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55602

Vulnerability Analysis

PwnDoc stores docx report templates on the backend filesystem and identifies each template by a name and file extension. The template update route accepts a JSON body containing name and ext fields, then writes the uploaded file using those values to construct the destination path. Because ext is trusted verbatim, an authenticated attacker can supply a value such as docx/../../../../etc/passwd and cause subsequent read operations to resolve outside the template directory. The download route later reads files based on the stored extension, returning the contents to the attacker. The result is arbitrary file read across the server, bounded only by the operating system permissions of the PwnDoc process.

Root Cause

The root cause is missing input validation on the req.body.ext parameter in the template controller at backend/src/routes/template.js. The application concatenates the extension into a filesystem path without normalizing directory separators or restricting characters. Traversal sequences and absolute path components are accepted, violating the assumption that ext is a short alphanumeric suffix.

Attack Vector

Exploitation requires an authenticated session with template update permissions. The attacker sends a crafted PUT or POST request to the template endpoint with a malicious ext value containing ../ traversal sequences. When the template is later downloaded, the backend reads and returns the contents of the traversed file. The attack is executed over the network with low complexity and does not require user interaction.

javascript

            return;
        }

+       // Fix for GHSA-2mqc-gg7h-76p6
+       if (req.body.ext && !utils.validFilename(req.body.ext)) {
+           Response.BadParameters(res, 'Bad name format');
+           return;
+       }
+
        var template = {};
        // Optional parameters
        if (req.body.name) template.name = req.body.name;

Source: PwnDoc security patch commit 1d4219c. The patch adds a call to utils.validFilename() that rejects any ext value containing path separators or other invalid filename characters before the template is persisted.

Detection Methods for CVE-2024-55602

Indicators of Compromise

Requests to /api/templates endpoints where the ext JSON field contains ../, ..\, /, or null-byte characters.
Template records stored in the database with ext values longer than a few characters or containing directory separators.
Unexpected outbound file downloads returning content-types inconsistent with docx templates.
Access log entries from low-privileged accounts fetching templates that resolve to system paths such as /etc/passwd, /proc/self/environ, or backend configuration files.

Detection Strategies

Deploy a web application firewall rule that inspects JSON bodies to the template API and blocks ext values failing a strict ^[A-Za-z0-9]{1,8}$ pattern.
Enable verbose application logging for the template update and download routes and alert on any request that returns non-template content.
Correlate authentication events with template modifications to identify accounts issuing crafted ext payloads shortly after login.

Monitoring Recommendations

Monitor the PwnDoc host filesystem for read access to sensitive files by the Node.js process owner.
Review MongoDB template collections for anomalous ext field values on a scheduled basis.
Track HTTP response sizes and content types on /api/templates/download to spot exfiltration of files outside the template directory.

How to Mitigate CVE-2024-55602

Immediate Actions Required

Update PwnDoc to a build that includes commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 or later.
Rotate any secrets, API tokens, or private keys that were readable by the PwnDoc service account, since arbitrary file read cannot be ruled out retroactively.
Audit PwnDoc user accounts and remove template management privileges from users who do not need them.
Restrict network exposure of the PwnDoc backend to trusted operator networks or a VPN.

Patch Information

The fix is published in PwnDoc commit 1d4219c and documented in GitHub Security Advisory GHSA-2mqc-gg7h-76p6. The patch introduces a utils.validFilename() check on the ext field in the template route handler and returns BadParameters when the value fails validation.

Workarounds

Run PwnDoc as an unprivileged user inside a container with a read-only root filesystem and no access to host secrets.
Place a reverse proxy in front of PwnDoc that validates the ext JSON field against an allowlist such as docx before forwarding requests.
Temporarily revoke template update rights from all non-administrative accounts until the patch is applied.

bash

# Example nginx snippet to block obvious traversal in template ext field
location /api/templates {
    if ($request_body ~* "\"ext\"\s*:\s*\"[^\"]*(\.\.|/|\\\\)") {
        return 400;
    }
    proxy_pass http://pwndoc_backend;
}