http4s up to 0.18.25/0.20.19/0.21.1 Request path traversal

Summaryinfo

A vulnerability was found in http4s up to 0.18.25/0.20.19/0.21.1. It has been declared as critical. Affected by this issue is some unknown functionality. The manipulation as part of Request results in path traversal. This vulnerability is known as CVE-2020-5280. Attacking locally is a requirement. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in http4s up to 0.18.25/0.20.19/0.21.1. It has been classified as critical. Affected is some unknown processing. The manipulation as part of a Request leads to a path traversal vulnerability. CWE is classifying the issue as CWE-23. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.

The weakness was published 03/25/2020 (GitHub Repository). The advisory is shared for download at github.com. This vulnerability is traded as CVE-2020-5280 since 01/02/2020. The attack needs to be approached locally. Required for exploitation is a authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 0.18.26, 0.20.20 or 0.21.2. Note that 0.19.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• http4s

Version

• 0.18.0
• 0.18.1
• 0.18.2
• 0.18.3
• 0.18.4
• 0.18.5
• 0.18.6
• 0.18.7
• 0.18.8
• 0.18.9
• 0.18.10
• 0.18.11
• 0.18.12
• 0.18.13
• 0.18.14
• 0.18.15
• 0.18.16
• 0.18.17
• 0.18.18
• 0.18.19
• 0.18.20
• 0.18.21
• 0.18.22
• 0.18.23
• 0.18.24
• 0.18.25
• 0.20.0
• 0.20.1
• 0.20.2
• 0.20.3
• 0.20.4
• 0.20.5
• 0.20.6
• 0.20.7
• 0.20.8
• 0.20.9
• 0.20.10
• 0.20.11
• 0.20.12
• 0.20.13
• 0.20.14
• 0.20.15
• 0.20.16
• 0.20.17
• 0.20.18
• 0.20.19
• 0.21.0
• 0.21.1

License

• open-source

Website

• Product: https://github.com/http4s/http4s/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion