GHSA-px9h-x66r-8mpc

Опубликовано: 13 мая 2020

Источник: github

Github: Прошло ревью

CVSS3: 5.3

Описание

path traversal in Jooby

Impact

Access to sensitive information available from classpath.

Patches

Patched version: 1.6.7 and 2.8.2

Commit 1.x: https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009

Commit 2.x: https://github.com/jooby-project/jooby/commit/c81479de67036993f406ccdec23990b44b0bec32

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

Latest 1.x version: 1.6.6

Arbitrary class path resource access 1

When sharing a File System directory as in:

assets("/static/**", Paths.get("static"));

The class path is also searched for the file (org.jooby.handlers.AssetHandler.loader): jooby/AssetHandler.java at 1.x · jooby-project/jooby · GitHub

private static Loader loader(final Path basedir, final ClassLoader classloader) { if (Files.exists(basedir)) { return name -> { Path path = basedir.resolve(name).normalize(); if (Files.exists(path) && path.startsWith(basedir)) { try { return path.toUri().toURL(); } catch (MalformedURLException x) { // shh } } return classloader.getResource(name); }; } return classloader::getResource; }

If we send /static/WEB-INF/web.xml it will fail to load it from the file system but will go into classloader.getResource(name) where name equals /WEB-INF/web.xml so will succeed and return the requested file. This way we can get any configuration file or even the application class files

If assets are configured for a certain extension we can still bypass it. eg:

assets("/static/**/*.js", Paths.get("static"));

We can send:

http://localhost:8080/static/io/yiss/App.class.js

Arbitrary class path resource access 2

This vulnerability also affects assets configured to access resources from the root of the class path. eg:

assets("/static/**");

In this case we can traverse static by sending:

http://localhost:8080/static/..%252fio/yiss/App.class

For more information

If you have any questions or comments about this advisory:

Open an issue in jooby
Email us at support@jooby.io

Ссылки

Пакеты

Наименование

io.jooby:jooby

maven

Затронутые версииВерсия исправления

< 2.8.2

2.8.2

Наименование

org.jooby:jooby

maven

Затронутые версииВерсия исправления

< 2.8.2

2.8.2

EPSS

Процентиль: 50%

0.00264

Низкий

5.3 Medium

CVSS3

CVE ID

CVE-2020-7647

Дефекты

CWE-22

Связанные уязвимости

CVE-2020-7647

CVSS3: 5.3

nvd

больше 5 лет назад

All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby are vulnerable to Directory Traversal via two separate vectors.

EPSS

Процентиль: 50%

0.00264

Низкий

5.3 Medium

CVSS3

CVE ID

CVE-2020-7647

Дефекты

CWE-22