Description
An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adapter file. **Note:** The attacker has to be logged in if the authentication is enabled (by default isn't enabled).
Remediation
References
https://github.com/ioBroker/ioBroker.js-controller/commit/f6e292c6750a491a5000d0f851b2fede4f9e2fda
https://snyk.io/vuln/SNYK-JS-IOBROKERJSCONTROLLER-534881
Related Vulnerabilities
CVE-2021-32730 Vulnerability in maven package org.xwiki.platform:xwiki-platform-administration-ui
CVE-2023-40014 Vulnerability in maven package org.webjars.npm:openzeppelin__contracts
CVE-2023-35157 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore
CVE-2023-36470 Vulnerability in maven package org.xwiki.platform:xwiki-platform-icon-default
CVE-2021-26117 Vulnerability in maven package org.apache.activemq:activemq-jaas