PT-2020-9932 · Eclipse · Eclipse Vert.X

Lhotari · Published 2020-10-15 · Updated 2022-02-10 · CVE-2019-17640

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 3.4.x through 3.9.4 Eclipse Vert.x versions 4.0.0.milestone1 through 4.0.0.Beta3

Description The issue arises from the StaticHandler in Eclipse Vert.x not correctly processing back slashes on Windows Operating systems. This allows an attacker to escape the webroot folder to the current working directory.

Recommendations For Eclipse Vert.x versions 3.4.x through 3.9.4, consider disabling the StaticHandler until a patch is available. For Eclipse Vert.x versions 4.0.0.milestone1 through 4.0.0.Beta3, consider disabling the StaticHandler until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

CVE-2019-17640

GHSA-VJW7-6GFQ-6WF5

Affected Products

Eclipse Vert.X

References · 20

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=567416 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17640 · Security Note
• https://osv.dev/vulnerability/GHSA-vjw7-6gfq-6wf5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-17640 · Vendor Advisory
• https://github.com/vert-x3/vertx-web/commit/b12f7c4c6576a8adc3f683b2899de4b0e7d099e4 · Note
• https://t.me/cvenotify/11840 · Telegram Post
• https://t.me/cibsecurity/15306 · Telegram Post
• https://t.me/cvenotify/16058 · Telegram Post
• https://lists.apache.org/thread.html/rfd0ebf8387cfd0b959d1e218797e709793cce51a5ea2f84d0976f47d@%3Ccommits.pulsar.apache.org%3E · Note
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E · Note
• https://lists.apache.org/thread.html/r8d863b148efe778ce5f8f961d0cafeda399e681d3f0656233b4c5511%40%3Ccommits.pulsar.apache.org%3E · Note
• https://lists.apache.org/thread.html/r8d863b148efe778ce5f8f961d0cafeda399e681d3f0656233b4c5511@%3Ccommits.pulsar.apache.org%3E · Note
• https://lists.apache.org/thread.html/r591f6932560c8c46cee87415afed92924a982189fea7f7c9096f8e33@%3Ccommits.pulsar.apache.org%3E · Note
• https://mvnrepository.com/artifact/io.vertx/vertx-web · Note
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E · Note