Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS01M2p4LXZ2ZjktNHgzOM4AAxhX

StaticHandler disclosure of classpath resources on Windows when mounted on a wildcard route

Summary

When running vertx web applications that serve files using StaticHandler on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard (*) then an attacker can exfiltrate any class path resource.

Details

When computing the relative path to locate the resource, in case of wildcards, the code:

https://github.com/vert-x3/vertx-web/blob/62c0d66fa1c179ae6a4d57344631679a2b97e60f/vertx-web/src/main/java/io/vertx/ext/web/impl/Utils.java#L83

returns the user input (without validation) as the segment to lookup. Even though checks are performed to avoid escaping the sandbox, given that the input was not sanitized \ are not properly handled and an attacker can build a path that is valid within the classpath.

PoC

https://github.com/adrien-aubert-drovio/vertx-statichandler-windows-traversal-path-vulnerability

Permalink: https://github.com/advisories/GHSA-53jx-vvf9-4x38
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01M2p4LXZ2ZjktNHgzOM4AAxhX
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: 5 months ago

CVSS Score: 4.8
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Identifiers: GHSA-53jx-vvf9-4x38, CVE-2023-24815
References:

• https://github.com/vert-x3/vertx-web/security/advisories/GHSA-53jx-vvf9-4x38
• https://nvd.nist.gov/vuln/detail/CVE-2023-24815
• https://github.com/vert-x3/vertx-web/commit/9e3a783b1d1a731055e9049078b1b1494ece9c15
• https://github.com/vert-x3/vertx-web/blob/62c0d66fa1c179ae6a4d57344631679a2b97e60f/vertx-web/src/main/java/io/vertx/ext/web/impl/Utils.java#L83
• https://github.com/advisories/GHSA-53jx-vvf9-4x38

Repository: https://github.com/vert-x3/vertx-web
Blast Radius: 18.4

Affected Packages