Vert.x-Web on Windows path traversal

Summaryinfo

A vulnerability labeled as critical has been found in Vert.x-Web on Windows. Affected by this issue is some unknown functionality. Such manipulation leads to path traversal. This vulnerability is documented as CVE-2023-24815. The attack can be executed remotely. There is not any exploit available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in Vert.x-Web on Windows (the affected version unknown) and classified as critical. Affected by this issue is an unknown part. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality. CVE summarizes:

Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using `StaticHandler` on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard (`*`) then an attacker can exfiltrate any class path resource. When computing the relative path to locate the resource, in case of wildcards, the code: `return "/" + rest;` from `Utils.java` returns the user input (without validation) as the segment to lookup. Even though checks are performed to avoid escaping the sandbox, given that the input was not sanitized `\` are not properly handled and an attacker can build a path that is valid within the classpath. This issue only affects users deploying in windows environments and upgrading is the advised remediation path. There are no known workarounds for this vulnerability.

The weakness was released 02/09/2023 as GHSA-53jx-vvf9-4x38. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2023-24815 since 01/30/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1006.

Applying the patch 9e3a783b1d1a731055e9049078b1b1494ece9c15 is able to eliminate this problem. The bugfix is ready for download at github.com.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Vert.x-Web

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion