Spark Sparkjava Framework up to 2.5 path traversal

Summaryinfo

A vulnerability labeled as critical has been found in Spark Sparkjava Framework up to 2.5. Affected by this vulnerability is an unknown functionality. Such manipulation with the input /..\..\spark\Spark.class leads to path traversal. Additionally, an exploit exists.

Detailsinfo

A vulnerability was found in Spark Sparkjava Framework up to 2.5 (Programming Language Software) and classified as critical. Affected by this issue is an unknown part. The manipulation with the input value /..\..\spark\Spark.class leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality.

The weakness was released 11/03/2016 by aj as Sparkjava Framework - Arbitrary File Read Vulnerability as not defined mailinglist post (Full-Disclosure). The advisory is shared for download at seclists.org. The public release happened without coordination with the vendor. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1006. The advisory points out:

The number of ..\ you need in the path depends on where in the classpath the static file location is configured to be. If you don't have the right amount then you don't get anything, but this is trivially brute forced. The classpath often has juicy things like configuration files and keystores, or you could look for non-framework class files and decompile them.

A public exploit has been developed by aj in URL and been published immediately after the advisory. The exploit is available at seclists.org. It is declared as proof-of-concept.

The mailinglist post contains the following remark:

If you need a workaround, don't use Spark to serve static files and move them to another web server.

Entry connected to this vulnerability is available at VDB-93320. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• Spark

Name

• Sparkjava Framework

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion