Path Traversal Vulnerability in Cloud Commander

Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contain a path traversal vulnerability in the GET /api/v1/pack endpoint. The flaw exists because the onGET handler at server/rest/index.js improperly calls an unguarded root() function rather than the secure root.resolve() validation wrapper used elsewhere in the application. An unauthenticated attacker can exploit this by sending percent-encoded directory traversal sequences within the pack request path. When processed, the application accesses files outside the intended root directory, archives them into a .tar.gz file, and streams the archive back to the requester. This allows attackers to exfiltrate sensitive host files such as /etc/passwd or SSH private keys. Given the ease of exploitation, organizations running affected versions of Cloud Commander should restrict access to the application or upgrade to a patched version immediately.

Impact

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files from the underlying host filesystem. This leads to the exposure of sensitive configuration files, system credentials, and SSH private keys, potentially resulting in full system compromise or lateral movement. The vulnerability impacts any environment utilizing these versions of Cloud Commander for remote file management.

Recommendation

• Upgrade Cloud Commander to a version outside of the 19.20.2 through 19.21.1 range immediately.
• Implement strict ingress filtering for the Cloud Commander API endpoints, specifically denying requests to /api/v1/pack containing traversal characters (e.g., ../).
• Enable web server access logs to audit all requests to /api/v1/pack and identify anomalous paths containing directory traversal patterns.