CyberRota Analysis
AI-GeneratedEclipse aeriOS Self-orchestrator versions prior to 1.2.1 are vulnerable to a path traversal flaw in the REST API, allowing unauthenticated remote attackers to manipulate filesystem paths and potentially write or delete files outside designated directories. The severity of this vulnerability is heightened by the API's lack of authentication and the elevated privileges of the container in which it operates. Organizations using affected versions should prioritize upgrading to 1.2.1 to mitigate the risk of unauthorized access and data manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An unauthenticated remote attacker able to access the Self-orchestrator API could therefore supply specially crafted identifiers containing path traversal sequences to write or delete JSON files outside the intended application directories, subject to the filesystem permissions of the Self-orchestrator process. The impact is increased by the absence of authentication on the affected API and by the container running with elevated privileges in the affected deployment configuration. The issue has been addressed in version 1.2.1 by introducing validation and sanitization of user-controlled identifiers before they are used to construct filesystem paths, preventing path separator characters from being used to escape the intended directories.