CloakBrowser Path Traversal Vulnerability in cloakserve Component Leading to Arbitrary Directory Deletion

A path traversal vulnerability has been identified in CloakBrowser versions through 0.3.27. The issue arises in the cloakserve CDP multiplexer, which uses the user-supplied fingerprint query parameter as a filesystem path component for creating Chrome profile directories. An unauthenticated attacker with access to the cloakserve port can inject crafted fingerprint values containing path traversal sequences. This manipulation can redirect the user_data_dir outside the designated data_dir. When the Chrome process fails to start or is terminated, the shutil.rmtree() function deletes the traversed path, causing arbitrary directory deletion. Additionally, cloakserve is bound to 0.0.0.0 by default, exposing it to the network.

Impact

Exploitation of this vulnerability allows for the arbitrary deletion of directories accessible to the service user.

Remediation

Users are advised to upgrade to CloakBrowser version 0.3.28 or later and restrict network access to the cloakserve port.