Skip to main content

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2022-37865

High
9.1/10

Summary

With Apache Ivy 2.4.0-rc1, an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they use pack200 or zip packaging. For artifacts using the "zip", "jar", or "war" packaging, Ivy doesn't verify the target path when extracting the archive. An archive containing absolute paths or paths that try to traverse "upwards" using ".." sequences can then write files to any location on the local file system that the user executing Ivy has write access to. This issue affects org.apache.ivy:ivy versions 2.4.0-rc1 through 2.5.0.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-22 - Path Traversal

Path traversal (or directory traversal), is a vulnerability that allows malicious users to traverse the server's root directory, gaining access to arbitrary files and folders such as application code & data, back-end credentials, and sensitive operating system files. In the worst-case scenario, an attacker could potentially execute arbitrary files on the server, resulting in a denial of service attack. Such an exploit may severely impact the integrity, confidentiality, and availability of an application.

References

Advisory Timeline

  • Published