« Volver al listado

CVE-2026-34783

Estado: AnalizadaAlta (8.1)—

Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library function allows a malicious website to write arbitrary files to the filesystem of the machine running Ferret. When an operator scrapes a website that returns filenames containing ../ sequences, and uses those filenames to construct output paths (a standard scraping pattern), the attacker controls both the destination path and the file content. This can lead to remote code execution via cron jobs, SSH authorized_keys, shell profiles, or web shells. This vulnerability is fixed in 2.0.0-alpha.4.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS con UI:R (interacción requerida: usuario abre/ejecuta Ferret en sitio malicioso). Path traversal permite escribir archivos arbitrarios → web shells, RCE via cron/SSH/shell profiles. T1203 explota el cliente (Ferret); impactos: web shell (T1505.003), ejecución de código (T1059), manipulac

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Disable or Remove Feature or ProgramUser Account ManagementRestrict Web-Based ContentRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data Storage

Tecnologías afectadas (1)

Montferret — Ferret

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-34783",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-34783",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-07T14:12:17.493517Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "MontFerret",
          "product": "ferret",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.0.0-alpha.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-04-06T17:17:10.430",
  "references": [
    {
      "url": "https://github.com/MontFerret/ferret/commit/160ebad6bd50f153453e120f6d909f5b83322917",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MontFerret/ferret/security/advisories/GHSA-j6v5-g24h-vg4j",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MontFerret/ferret/security/advisories/GHSA-j6v5-g24h-vg4j",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library function allows a malicious website to write arbitrary files to the filesystem of the machine running Ferret. When an operator scrapes a website that returns filenames containing ../ sequences, and uses those filenames to construct output paths (a standard scraping pattern), the attacker controls both the destination path and the file content. This can lead to remote code execution via cron jobs, SSH authorized_keys, shell profiles, or web shells. This vulnerability is fixed in 2.0.0-alpha.4."
    }
  ],
  "lastModified": "2026-06-17T10:39:37.080",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:montferret:ferret:*:*:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5ABE84D9-EFCF-4AEF-8A0A-CB71C1F25069",
              "versionEndExcluding": "2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:montferret:ferret:2.0.0:alpha1:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "210E958B-0BF8-4176-9D5F-B0C830B43E95"
            },
            {
              "criteria": "cpe:2.3:a:montferret:ferret:2.0.0:alpha2:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BABC4531-C6A0-4B56-9CB4-6EAE7ED01696"
            },
            {
              "criteria": "cpe:2.3:a:montferret:ferret:2.0.0:alpha3:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "24AD5875-C977-47CE-BE8F-3CCC4BF07045"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}