GHSA-6XV5-86Q9-7XR8

Vulnerability from github – Published: 2023-09-07 12:58 – Updated: 2023-09-07 12:58
VLAI?
Summary
SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced
Details

Impact

For Windows users of github.com/cyphar/filepath-securejoin, until v0.2.4 it was possible for certain rootfs and path combinations (in particular, where a malicious Unix-style /-separated unsafe path was used with a Windows-style rootfs path) to result in generated paths that were outside of the provided rootfs.

It is unclear to what extent this has a practical impact on real users, but given the possible severity of the issue we have released an emergency patch release that resolves this issue.

Thanks to @pjbgf for discovering, debugging, and fixing this issue (as well as writing some tests for it).

Patches

c121231e1276e11049547bee5ce68d5a2cfe2d9b is the patch fixing this issue. v0.2.4 contains the fix.

Workarounds

Users could use filepath.FromSlash() on all unsafe paths before passing them to filepath-securejoin.

References

See #9.

Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cyphar/filepath-securejoin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-07T12:58:58Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\nFor Windows users of `github.com/cyphar/filepath-securejoin`, until v0.2.4 it was possible for certain rootfs and path combinations (in particular, where a malicious Unix-style `/`-separated unsafe path was used with a Windows-style rootfs path) to result in generated paths that were outside of the provided rootfs.\n\nIt is unclear to what extent this has a practical impact on real users, but given the possible severity of the issue we have released an emergency patch release that resolves this issue.\n\nThanks to  @pjbgf for discovering, debugging, and fixing this issue (as well as writing some tests for it).\n\n### Patches\nc121231e1276e11049547bee5ce68d5a2cfe2d9b is the patch fixing this issue. v0.2.4 contains the fix.\n\n### Workarounds\nUsers could use `filepath.FromSlash()` on all unsafe paths before passing them to `filepath-securejoin`.\n\n### References\nSee #9.",
  "id": "GHSA-6xv5-86q9-7xr8",
  "modified": "2023-09-07T12:58:58Z",
  "published": "2023-09-07T12:58:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cyphar/filepath-securejoin/security/advisories/GHSA-6xv5-86q9-7xr8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cyphar/filepath-securejoin/pull/9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cyphar/filepath-securejoin/commit/c121231e1276e11049547bee5ce68d5a2cfe2d9b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cyphar/filepath-securejoin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cyphar/filepath-securejoin/releases/tag/v0.2.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.