CyberRota Analysis
AI-GeneratedOpenChamber 1.11.7 is vulnerable to a path traversal flaw in its file-serving endpoints, allowing unauthenticated remote attackers to read arbitrary files by manipulating query parameters. This critical vulnerability can lead to the exposure of sensitive information, including JWT signing secrets and API credentials, potentially enabling full authentication bypass on affected systems. Organizations using this version of OpenChamber should prioritize immediate remediation to protect against unauthorized access and data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassing the workspace boundary check in resolveReadPathFromContext. Attackers can exploit the vacuous isPathWithinRoot guard to read sensitive files such as the JWT signing secret, SSH private keys, API credentials, and environment variables, enabling full authentication bypass by forging session cookies on password-protected deployments.