CVE-2022-39345

Executive Summary

CVE-2022-39345 is a critical path traversal vulnerability in Gin-vue-admin, a full-stack backstage management system built on Vue.js and the Gin web framework for Go. The flaw affects all versions prior to 2.5.4 and enables unauthenticated remote attackers to perform arbitrary file uploads by exploiting insufficient path sanitization. With a CVSS score of 9.8, successful exploitation can lead to complete compromise of the underlying server, potentially allowing attacker-controlled code execution, data theft, or lateral movement within the enterprise network. No workarounds exist; upgrading to version 2.5.4 is the only reliable remediation.

Technical Analysis

Gin-vue-admin separates the frontend (Vue.js) from the backend (Gin framework in Go). The vulnerability arises from a path traversal flaw in the file upload functionality. According to the CNA Title and NVD description, the application fails to properly validate or sanitize user-supplied filenames during the upload process. An attacker can manipulate file path components (e.g., using ../ sequences) within the upload request to direct the written file to a directory outside the intended upload directory.

This is fundamentally a CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability. The attack surface is the publicly exposed file upload endpoint, which is a standard feature in management systems for document attachments, avatars, or similar content. Because the backend is written in Go using the Gin framework, the file handling code likely relies on the provided filename without normalizing it against the target directory. When the upload request is processed, the path traversal sequence causes the file to be written to an attacker-determined location on the server's filesystem.

The practical consequence is arbitrary file upload. While the NVD description does not provide specific function names or URL endpoints, the vulnerability class permits a remote attacker to upload web shells, scripts, or configuration files to directories that the server can execute or interpret. The criticality is amplified because the vulnerability is exploitable without authentication (CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N), meaning any unauthenticated party able to reach the web interface can attempt exploitation. Insufficient technical detail is available to identify the exact vulnerable function; the mechanism is inferred from the path traversal classification.

Exploitation Scenarios

The attack chain for CVE-2022-39345 is reconstructed at the vulnerability-class level, as no public PoC exists and the NVD description does not expose implementation-specific details.

Step 1 — Reconnaissance/Target Identification: An attacker scans for internet-facing instances of Gin-vue-admin, which typically present a distinctive login interface rendered by the Vue.js frontend. Shodan queries such as title:"gin-vue-admin" or detection of signature JavaScript bundles can identify candidate targets. The attacker confirms version < 2.5.4 via version strings in static assets, response headers, or API behaviors.

Step 2 — Flaw Triggering: The attacker sends an HTTP multipart/form-data POST request to the file upload endpoint. The filename field inside the multipart body is crafted with path traversal sequences (../ repeated) to escape the designated upload directory. For example, a filename containing ../../../../etc/cron.d/payload or ../../../../var/www/html/shell.go is submitted. The server's file-writing routine does not strip or normalize these segments, so the file lands at the traversed path.

Step 3 — Payload/Execution Method: At the vulnerability-class level, the attacker uploads a file containing server-side executable content (e.g., a script compatible with the server runtime, a webshell, or a Go source file). The upload succeeds because the traversal bypasses directory restrictions. If the traversed path lands in a web-accessible directory, the attacker can directly invoke the uploaded file over HTTP. Alternatively, the attacker could overwrite a sensitive configuration or cron file to trigger execution during normal system operations.

Step 4 — Post-Exploitation Impact: With an arbitrary file on the server, an attacker may achieve remote code execution (if the file lands in an executable context), persistent backdoor access, sensitive data exfiltration, or privilege escalation. Systems affected include any enterprise infrastructure deploying Gin-vue-admin as their management panel, putting all underlying data and connected services at risk. No public PoC is available; this attack chain is inferred from the path traversal vulnerability class.

Impact Assessment

The CVSS base score of 9.8 places this in the critical severity band, reflecting full compromise potential. The vector (N/A provided; inferred from score and description) implies network exploitability without privileges or user interaction.

• Confidentiality: High — attacker can read arbitrary files or pivot to data stores.
• Integrity: High — arbitrary file writes allow modification of configurations, source code, or content.
• Availability: High — attacker may overwrite critical system files, corrupt the application, or plant destructive payloads.
• Blast Radius: Any enterprise relying on Gin-vue-admin as a management backend. The separation of frontend (Vue) and backend (Gin) does not reduce risk — the backend serves the upload endpoint.
• EPSS Context: EPSS score of 0.01361 (69.1% percentile) suggests low-to-moderate current exploitation likelihood but does not diminish the severity once actively targeted.

Detection Guidance

Sigma Rule

title: Gin-vue-admin Path Traversal File Upload Attempt
id: 8c8b1d9e-2a3b-4c5d-8e6f-1a2b3c4d5e6f
status: experimental
description: Detects path traversal patterns in file upload requests targeting Gin-vue-admin
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-39345
author: Valters IT Threat Intelligence
date: 2024/01/15
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2022.39345
logsource:
    category: webserver
    product: nginx
detection:
    selection_method:
        c-method: 'POST'
    selection_path:
        cs-uri-stem|cstartswith:
            - '/upload'
            - '/api/upload'
    selection_pattern:
        - request.body contains '../'
        - request.body contains '..\\'
        - request.body contains '%2e%2e%2f'
        - request.body contains '%2e%2e%5c'
    condition: selection_method and selection_path and selection_pattern
level: high
falsepositives:
    - Legitimate file uploads with names containing dots (rare)

YARA Rule

rule gin_vue_admin_path_traversal_upload {
    meta:
        author = "Valters IT Threat Intelligence"
        date = "2024-01-15"
        description = "Detects path traversal payloads in file upload requests targeting Gin-vue-admin (CVE-2022-39345)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-39345"
        severity = "critical"
    strings:
        $s1 = "../" ascii
        $s2 = "..\\" ascii
        $s3 = "..%2f" ascii nocase
        $s4 = "..%5c" ascii nocase
        $s5 = "Content-Disposition: form-data; name=" ascii
        $s6 = "filename=\"" ascii
        $s7 = "/etc/" ascii
        $s8 = "var/www" ascii
        $s9 = ".go" ascii
    condition:
        uint16(0) == 0x0d0a and (($s1 or $s2 or $s3 or $s4) and $s6) and (1 of ($s7, $s8, $s9))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"Gin-vue-admin Path Traversal File Upload Attempt (CVE-2022-39345)"; flow:to_server,established; content:"POST"; http_method; content:"/upload"; http_uri; content:"filename=\""; http_client_body; pcre:"/(\.\.(\/|\\)|%2e%2e(\/|\\|%2f|%5c))/i"; classtype:attempted-admin; sid:10039345; rev:1; reference:cve,2022-39345; metadata:created_at 2024_01_15, updated_at 2024_01_15;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where event.type == "start" and destination.port == 80 ]
  [ http where request.method == "POST" and
      request.uri : "/upload*" and
      ( request.body : "*../*" or request.body : "*%2e%2e*" ) and
      request.body : "*filename=*" ]

Splunk SPL Query

sourcetype="iis" OR sourcetype="nginx:plus:access"
| where method="POST"
| search uri="*/upload*" 
| regex _raw="(\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c)"
| regex _raw="filename=\".*?\""
| table _time, src_ip, uri, http_user_agent, _raw
| sort - _time

Wazuh OSSEC Rule

<group name="gin-vue-admin,">
  <rule id="405315" level="12">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <field name="url">/upload</field>
    <match>\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c</match>
    <description>Gin-vue-admin path traversal file upload attempt (CVE-2022-39345)</description>
    <group>attack.initial_access,attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source). Note the contradiction: the NVD description explicitly states version 2.5.4 contains a patch, yet the patch confidence score is 0/4. The safest operational approach is to treat the system as vulnerable until upgrade is verified.

1. Immediate Mitigations (no patch confirmed installed):

   • Verify running version; if < 2.5.4, assume compromise or imminent risk.
   • Block external access to the management interface via firewall or WAF rules.
   • If feasible, disable file upload functionality temporarily via configuration.
   • Add WAF rules to block URI patterns containing ../, ..\, or URL-encoded variants in upload requests.

2. Patch/Upgrade Steps:

   • Upgrade to version 2.5.4 or later immediately (this is the specified patched version).
   • Validate the integrity of the new binary/source before deployment.
   • Test the upgrade in a staging environment, then deploy across all instances.
   • After upgrade, audit all uploaded files since deployment for suspicious content.

3. Long-Term Hardening:

   • Implement a web application firewall (WAF) for ongoing path traversal filtering.
   • Restrict the upload directory to a dedicated, non-executable partition.
   • Enforce strict filename validation (allowlists of characters, reject any name containing /, \, or . sequences other than the final file extension).
   • Require authentication for all upload endpoints by default; review access controls.
   • Implement file integrity monitoring (FIM) on critical web directories.
   • Monitor logs for abnormal upload patterns (large files, unusual filenames, rapid successive uploads).

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2022-39345
2. CNA Advisory: GitHub Security Advisory for gin-vue-admin (GHSA) — reference linked via NVD CNA fields; patch noted in release 2.5.4.
3. Vendor Repository: https://github.com/flipped-aurora/gin-vue-admin (release tags for up to v2.5.4).
4. CISA KEV Status: Not listed in CISA Known Exploited Vulnerabilities catalog (confirmed NO).

Threat Actor Intelligence: As of this report, no public exploit code, Nuclei template, or in-the-wild campaign evidence has been identified for CVE-2022-39345. The EPSS score (0.01361, 69.1% percentile) indicates moderate exploitation likelihood based on environmental modeling. Enterprise teams should nonetheless prioritize patching given the trivial complexity of path traversal exploitation against exposed management consoles. Monitor vendor release notes and community channels for emerging exploit activity.