Halo Theme Installation Path Traversal Vulnerability Allowing Arbitrary File Write

A path traversal vulnerability has been identified in the Halo open-source project, specifically in versions through 2.24.2. The issue arises in the ThemeUtils.unzipThemeTo function within ThemeUtils.java, where the argument metadata.name is not properly validated. This lack of validation allows for path traversal attacks, enabling files to be written outside the intended theme directory. The vulnerability can be exploited remotely, and the exploit is publicly available.

Impact

Exploitation of this vulnerability allows for arbitrary file writing outside the intended theme directory. Files can be written to the public static directory, potentially leading to persistent content injection or stored cross-site scripting, depending on the content of the written files. Additionally, if the Halo process has write permissions to sensitive directories, the impact could be even greater.

Reproduction

To reproduce this vulnerability, upload a malicious theme zip file containing a theme.yaml file with a path traversal payload in the metadata.name field. The uploaded theme will be extracted to a location outside the intended directory, allowing for unauthorized file writes.

Remediation

It is recommended to validate the metadata.name field in theme.yaml to ensure it does not contain path traversal sequences. Normalize and validate the final target path before copying files to prevent unauthorized access to sensitive directories.