CyberRota Analysis
AI-GeneratedNitroShare Desktop versions up to 0.3.4 are vulnerable to a path traversal flaw in their LAN file transfer server, allowing unauthenticated attackers on the same network to write arbitrary files by exploiting directory traversal sequences in the JSON item header. This vulnerability can lead to unauthorized file placement in sensitive locations, such as the Windows Startup folder, facilitating persistent code execution upon user login. Organizations using NitroShare should prioritize patching this vulnerability to mitigate the risk of unauthorized access and potential malware deployment.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending a crafted filename containing directory traversal sequences in the JSON item header name field. Attackers can exploit the lack of path validation to write files outside the transfer root directory to arbitrary locations the current user has write access, including the Windows Startup folder, enabling persistent code execution on the next user login.