CyberRota Analysis
AI-GeneratedBruno versions up to 3.4.2 are vulnerable due to inadequate validation of file paths in request body declarations, enabling attackers to exploit directory traversal vulnerabilities. This flaw allows unauthorized access to arbitrary local files, which can be exfiltrated to attacker-controlled endpoints during collection execution. Organizations using affected versions should prioritize remediation to mitigate the risk of sensitive data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker-controlled endpoints.