Hunvreus Devpush Storage Reset Failure Handler Improper Exception Management Vulnerability

A vulnerability exists in Hunvreus Devpush versions up to 0.4.6 within the Storage Reset Failure Handler component. The issue arises in the reset_storage function located in app/workers/tasks/storage.py, where exceptional conditions are not properly managed. This flaw can lead to a misleading storage status, allowing old data to be incorrectly considered as cleared. The vulnerability is associated with a high complexity level, making exploitation challenging.

Impact

The vulnerability can cause users to mistakenly believe that storage has been successfully reset, when in fact, old data remains intact. This can lead to continued reliance on a storage resource that has not been properly cleared.

Reproduction

To reproduce this vulnerability, log in as a team admin or owner and initiate a storage reset. This can be done by sending a POST request to the appropriate endpoint for the team and storage name, including a valid session cookie and CSRF token. Once the reset is triggered, cause the operation to fail by introducing a permissions or deletion error in the volume or database reset path. Despite the failure, the worker will record the error and still set the storage status to 'active', creating a false impression that the reset was successful.

Remediation

The storage reset function should be modified to ensure that if a reset fails, the status is either set to 'failed' or the previous state is restored. Additionally, consider blocking normal operations while an error is present after a failed reset.