Security Advisory

CVE-2024-53982: ZOO-Project Arbitrary File Download via Echo Example Caching

Path traversal in the ZOO-Project Echo example allows arbitrary file download through attacker-controlled caching parameters.

Overview

ZOO-Project is an open source Web Processing Service server written in C. The Echo example service ships enabled in default installs and caches files based on parameters the client supplies. Nothing validates those parameters.

An unauthenticated attacker controls which file the service returns and downloads any file the server process can read. The fix landed in commit 641cb18 on 22 November 2024.

Affected products

  • ZOO-Project before commit 641cb18fec58de43a3468f314e5f8808c560e6d9

Disclosure timeline

22 Nov 2024
Fix committed to ZOO-Project
04 Dec 2024
GitHub advisory and CVE-2024-53982 published

XBOW blog: ZOO-Project arbitrary file download