Northern.tech Mender Server Directory Traversal Vulnerability

A directory traversal vulnerability has been identified in Northern.tech Mender Server versions 4.1.0, 4.0.1 and earlier. The issue arises from improper input sanitization in the endpoint for creating artifacts, which can be accessed through the UI or API. This flaw allows an attacker to include path traversal sequences in requests, enabling them to access and modify files outside the intended directory. In a multi-tenant environment like hosted Mender, this could lead to injecting malicious code into artifacts, potentially compromising the containers of other users.

Impact

Exploitation of this vulnerability could allow an attacker to inject arbitrary code into Mender artifacts, which could then be executed on devices using the Mender Client, bypassing signature verification. In a multi-tenant hosted Mender environment, where many users access the same APIs, the impact is severe. However, for on-premise installations, the risk is lower due to fewer users and the inability to easily sign up for accounts.

Remediation

Users are advised to upgrade to Mender Server versions 4.1.1 or 4.0.2. Detailed upgrade instructions are available in the Mender documentation.