PT-2020-19680 · Jooby · Jooby

Jknack

·

Published

2020-05-11

·

Updated

2020-05-14

·

CVE-2020-7647

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions io.jooby:jooby versions prior to 1.6.7 org.jooby:jooby versions prior to 1.6.7 io.jooby:jooby versions 2.0.0 through 2.8.2 org.jooby:jooby versions 2.0.0 through 2.8.2
Description The issue allows access to sensitive information available from the classpath via Directory Traversal. This can be achieved through two separate vectors. When sharing a file system directory, the class path is also searched for the file, allowing an attacker to access configuration files or application class files. Additionally, assets configured to access resources from the root of the class path can be traversed, enabling an attacker to access sensitive information.
Recommendations For io.jooby:jooby versions prior to 1.6.7, update to version 1.6.7. For org.jooby:jooby versions prior to 1.6.7, update to version 1.6.7. For io.jooby:jooby versions 2.0.0 through 2.8.2, update to version 2.8.2. For org.jooby:jooby versions 2.0.0 through 2.8.2, update to version 2.8.2. As a temporary workaround, consider restricting access to sensitive information available from the classpath until a patch is available. Avoid using the assets function with file system directories or class path resources until the issue is resolved.

Exploit

Fix

Path traversal

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2020-7647
GHSA-PX9H-X66R-8MPC
SNYK-JAVA-IOJOOBY-568806
SNYK-JAVA-ORGJOOBY-568807

Affected Products

Jooby