Blinko Authenticated Arbitrary File Write Vulnerability in saveAdditionalDevFile Endpoint

A path traversal vulnerability allowing authenticated users to write arbitrary files has been identified in Blinko versions prior to 1.8.4. The issue resides in the saveAdditionalDevFile endpoint, where user input is not properly validated, enabling low privilege users to exploit the vulnerability by overwriting sensitive files or executing malicious scripts.

Impact

Exploitation of this vulnerability could lead to unauthorized file writes, with potential consequences such as overwriting SSH keys, modifying system configurations, or writing cron tasks that could be used to execute commands remotely.

Remediation

Users can upgrade to Blinko version 1.8.4 or later to address this vulnerability.