A vulnerability was found in http4s up to 0.18.25/0.20.19/0.21.1. It has been classified as critical. Affected is some unknown processing. The manipulation as part of a Request leads to a path traversal vulnerability. CWE is classifying the issue as CWE-23. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.

The weakness was published 03/25/2020 (GitHub Repository). The advisory is shared for download at github.com. This vulnerability is traded as CVE-2020-5280 since 01/02/2020. The attack needs to be approached locally. Required for exploitation is a authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 0.18.26, 0.20.20 or 0.21.2. Note that 0.19.0 eliminates this vulnerability.

Productinfo

Name

• http4s

Version

• 0.18.0
• 0.18.1
• 0.18.2
• 0.18.3
• 0.18.4
• 0.18.5
• 0.18.6
• 0.18.7
• 0.18.8
• 0.18.9
• 0.18.10
• 0.18.11
• 0.18.12
• 0.18.13
• 0.18.14
• 0.18.15
• 0.18.16
• 0.18.17
• 0.18.18
• 0.18.19
• 0.18.20
• 0.18.21
• 0.18.22
• 0.18.23
• 0.18.24
• 0.18.25
• 0.20.0
• 0.20.1
• 0.20.2
• 0.20.3
• 0.20.4
• 0.20.5
• 0.20.6
• 0.20.7
• 0.20.8
• 0.20.9
• 0.20.10
• 0.20.11
• 0.20.12
• 0.20.13
• 0.20.14
• 0.20.15
• 0.20.16
• 0.20.17
• 0.20.18
• 0.20.19
• 0.21.0
• 0.21.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion