Key points
- CVE-2022-51024 affects Kavita versions prior to 0.5.4.1 with a CVSS score of 8.7.
- Attackers use unauthenticated GET requests to read files outside the intended directory.
- Shadowserver Foundation first recorded exploitation evidence on October 18, 2023.
The Shadowserver Foundation reported observing active exploitation of a path traversal vulnerability in Kavita 0.5.2 on October 18, 2023. This high-severity flaw allows unauthenticated attackers to read arbitrary files on affected systems by manipulating filename parameters in API requests.
The vulnerability, tracked as CVE-2022-51024, carries a CVSS score of 8.7. It stems from improper handling of user-supplied input in the filename parameter. Attackers can supply directory traversal sequences such as '../' to escape the temporary directory and access sensitive configuration files like appsettings.json.
Technical context
This issue is classified under CWE-22, which covers improper limitation of a pathname to a restricted directory. The flaw exists in the /api/image/cover-upload endpoint. By sending GET requests with crafted filename values, attackers can retrieve data residing outside the expected upload directory without providing any credentials.
Affected environments
The vulnerability impacts Kareadita Kavita versions earlier than 0.5.4.1. Any instance running these older versions is exposed to the same risk profile. Organizations relying on this self-hosted e-book server must verify their current version to determine if they fall within the affected range.
Next steps
Administrators should immediately inventory their deployments to identify any instances running Kavita versions before 0.5.4.1. Since exploitation has been observed in the wild, delaying remediation increases the risk of data exposure. Teams should prioritize upgrading to the patched version as soon as possible to close this entry point.
Signals worth monitoring
Security teams should review web server access logs for anomalous GET requests targeting the image upload API endpoint. Look for unusual filename parameters containing directory traversal sequences like double dots and slashes. Check for successful responses returning configuration file contents or unexpected data types. Investigate any unauthenticated access attempts to sensitive endpoints. Verify that file integrity monitoring tools detect unauthorized reads of critical system files.
What to do and how to stay safe: Kavita
- Audit all Kavita installations to confirm they are running version 0.5.4.1 or later.
- Review web server logs for GET requests to /api/image/cover-upload with suspicious filename parameters.
- Restrict network access to the Kavita instance to trusted IP ranges if immediate patching is not possible.
- Monitor for unauthorized access to configuration files such as appsettings.json.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this Kavita vulnerability?
The vulnerability is identified as CVE-2022-51024.
Which versions of Kavita are affected by this flaw?
Versions of Kareadita Kavita before 0.5.4.1 are affected.
When was exploitation of this vulnerability first observed?
The Shadowserver Foundation first observed exploitation evidence on October 18, 2023.
