Summary
Countly's authenticated data-migration deletion route does not adequately validate the user-controlled export identifier before using it to build a filesystem path. An application administrator or user with migration permission may exploit this behavior to delete writable files or directory trees, potentially causing data loss or service disruption.
Countly's authenticated data-migration deletion route does not adequately validate the user-controlled export identifier before using it to build a filesystem path. An application administrator or user with migration permission may exploit this behavior to delete writable files or directory trees, potentially causing data loss or service disruption.
Affected context
The vulnerability occurs in Countly's data-migration functionality when an authenticated request supplies an export identifier that is incorporated into a cleanup path. It is relevant where the migration service can write to or remove filesystem content outside the intended import directory and where the requesting account has administrator or migration-related permissions.
The vulnerability occurs in Countly's data-migration functionality when an authenticated request supplies an export identifier that is incorporated into a cleanup path. It is relevant where the migration service can write to or remove filesystem content outside the intended import directory and where the requesting account has administrator or migration-related permissions.
Exploit preconditions
- Attack surface: Authenticated data-migration deletion API
- Required access: Application administrator privileges or permission to perform data migrations
- Trigger point: Cleanup processing after a migration-related deletion request
- Required condition: The attacker can influence the export identifier used to construct the cleanup path
- Why exploitation is possible: The identifier is concatenated into a filesystem path without sufficient containment validation, allowing cleanup operations to resolve outside the intended directory
- Attack surface: Authenticated data-migration deletion API
- Required access: Application administrator privileges or permission to perform data migrations
- Trigger point: Cleanup processing after a migration-related deletion request
- Required condition: The attacker can influence the export identifier used to construct the cleanup path
- Why exploitation is possible: The identifier is concatenated into a filesystem path without sufficient containment validation, allowing cleanup operations to resolve outside the intended directory
Why this happens
The underlying bug is improper neutralization of path elements in a user-controlled filesystem identifier. The migration helper constructs a path by concatenating the supplied export identifier and then performs recursive removal without reliably confirming that the resulting path remains within the designated import directory. This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal.
The underlying bug is improper neutralization of path elements in a user-controlled filesystem identifier. The migration helper constructs a path by concatenating the supplied export identifier and then performs recursive removal without reliably confirming that the resulting path remains within the designated import directory. This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal.
Potential impact
- Writable application files may be deleted
- Directory trees may be removed recursively
- Application data may be lost
- Services may become unavailable or unstable
- Recovery operations may require restoration from backups
- Other tenants or components sharing writable storage could be affected
- Writable application files may be deleted
- Directory trees may be removed recursively
- Application data may be lost
- Services may become unavailable or unstable
- Recovery operations may require restoration from backups
- Other tenants or components sharing writable storage could be affected
General mitigation guidance
Mitigation should focus on enforcing filesystem containment and reducing trust in request-derived path components.
Common defensive patterns include:
- Resolve candidate paths canonically and verify that they remain beneath a fixed, approved base directory
- Use server-generated opaque identifiers rather than accepting filesystem-relevant names from clients
- Prefer controlled object or storage APIs over direct path construction
- Reject path separators, traversal elements, symbolic-link escapes, and unexpected identifier formats
- Limit recursive deletion to explicitly enumerated files and directories
- Apply least-privilege filesystem permissions and isolate migration storage from unrelated application data
- Require authorization checks at the operation and resource level
- Use backups, deletion safeguards, and audit logging for destructive migration actions
Mitigation should focus on enforcing filesystem containment and reducing trust in request-derived path components.
Common defensive patterns include:
- Resolve candidate paths canonically and verify that they remain beneath a fixed, approved base directory
- Use server-generated opaque identifiers rather than accepting filesystem-relevant names from clients
- Prefer controlled object or storage APIs over direct path construction
- Reject path separators, traversal elements, symbolic-link escapes, and unexpected identifier formats
- Limit recursive deletion to explicitly enumerated files and directories
- Apply least-privilege filesystem permissions and isolate migration storage from unrelated application data
- Require authorization checks at the operation and resource level
- Use backups, deletion safeguards, and audit logging for destructive migration actions
How teams detect issues like this
Organizations can look for:
- Static analysis findings where request parameters are concatenated into filesystem paths
- Code review signals involving recursive deletion, path resolution, or cleanup helpers fed by user input
- Missing canonical-path containment checks before file operations
- Runtime monitoring of migration endpoints followed by unusual deletion activity
- File-integrity monitoring for unexpected changes beneath application and shared-storage directories
- Policy checks requiring approved path-handling utilities and authorization for destructive operations
Automated security review tools may help identify path construction and unsafe file-operation patterns during development.
Organizations can look for:
- Static analysis findings where request parameters are concatenated into filesystem paths
- Code review signals involving recursive deletion, path resolution, or cleanup helpers fed by user input
- Missing canonical-path containment checks before file operations
- Runtime monitoring of migration endpoints followed by unusual deletion activity
- File-integrity monitoring for unexpected changes beneath application and shared-storage directories
- Policy checks requiring approved path-handling utilities and authorization for destructive operations
Automated security review tools may help identify path construction and unsafe file-operation patterns during development.
