PT-2020-17515 · Mozilla · Mozwire

Published 2020-08-18 · Updated 2021-08-25 · CVE-2020-35883

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions mozwire crate through 2020-08-18

Description An issue in the mozwire crate allows a ../ directory-traversal situation, enabling the overwriting of local files that have .conf at the end of the filename. This occurs because the client software downloads a list of servers from Mozilla's servers and creates local files named after the hostname field in the JSON document without verifying the content of the string, which could include '../' and lead to path traversal. An attacker in control of Mozilla's servers could exploit this to overwrite or create local files named .conf.

Recommendations For mozwire crate through 2020-08-18, the flaw was corrected by sanitizing the hostname field, implying that updating to a version where this fix is applied would resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-35883

GHSA-4VHW-4RW7-JFPV

RUSTSEC-2020-0030

Affected Products

Mozwire

References · 10

• https://osv.dev/vulnerability/RUSTSEC-2020-0030 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35883 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35883 · Security Note
• https://osv.dev/vulnerability/GHSA-4vhw-4rw7-jfpv · Vendor Advisory
• https://github.com/NilsIrl/MozWire/pull/17/commits/dd0639bf2876773b66382f47285f7db701f628d9 · Note
• https://github.com/NilsIrl/MozWire/issues/14 · Note
• https://github.com/NilsIrl/MozWire · Note
• https://rustsec.org/advisories/RUSTSEC-2020-0030.html · Note
• https://t.me/cvenotify/8013 · Telegram Post
• https://crates.io/crates/mozwire · Note