x-crypto prior 0.0.0-20220525230936-793ad666bf5e on Go path traversal

Summaryinfo

A vulnerability categorized as problematic has been discovered in x-crypto on Go. Impacted is an unknown function. The manipulation results in path traversal. This vulnerability is cataloged as CVE-2022-30636. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in x-crypto on Go. Affected is an unknown functionality. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-23. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. This is going to have an impact on confidentiality. CVE summarizes:

httpTokenCacheKey uses path.Base to extract the expected HTTP-01 token value to lookup in the DirCache implementation. On Windows, path.Base acts differently to filepath.Base, since Windows uses a different path separator (\ vs. /), allowing a user to provide a relative path, i.e. .well-known/acme-challenge/..\..\asd becomes ..\..\asd. The extracted path is then suffixed with +http-01, joined with the cache directory, and opened. Since the controlled path is suffixed with +http-01 before opening, the impact of this is significantly limited, since it only allows reading arbitrary files on the system if and only if they have this suffix.

This vulnerability is traded as CVE-2022-30636 since 05/12/2022. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1006.

The vulnerability scanner Nessus provides a plugin with the ID 224686 (Linux Distros Unpatched Vulnerability : CVE-2022-30636), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.0.0-20220525230936-793ad666bf5e eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (224686). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• x-crypto

Version

• 0.0.0-20200220183623-bac4c82f6975
• 0.0.0-20211202192323-5770296d904e

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion