thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to write or truncate files outside the workspace with daemon privileges.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
thclaws:thclaws
References 4
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/thclaws-api-inputs-symlink-escape
NVD
https://github.com/thClaws/thClaws/blob/v0.141.0/crates/core/src/api_v1/artifac…
NVD
https://github.com/thClaws/thClaws
NVD
https://www.vulncheck.com/advisories/thclaws-through-0.141.0-symlink-following-…
VulnCheck Advisory: thClaws through 0.141.0 Symlink Following File Write via POST /v1/inputs