PT-2021-19826 · Http4S · Http4S
Rossabaker
·
Published
2021-05-27
·
Updated
2021-06-10
·
CVE-2021-32643
CVSS v3.1
5.8
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
http4s versions 0.21.7 through 0.21.23
http4s versions 0.22.0-M1 through 0.22.0-M8
http4s version 0.23.0-M1
http4s versions 1.0.0-M1 through 1.0.0-M22
Description
The
StaticFile.fromUrl function can leak the presence of a directory on a server when the URL scheme is not file://, and the URL points to a fetchable resource under its scheme and authority. The function returns F[None], indicating no resource, if url.getFile is a directory, without first checking the scheme or authority of the URL. If a URL connection to the scheme and URL would return a stream, and the path in the URL exists as a directory on the server, the presence of the directory on the server could be inferred from the 404 response. The contents and other metadata about the directory are not exposed.Recommendations
For versions 0.21.7 through 0.21.23, update to version v0.21.24.
For versions 0.22.0-M1 through 0.22.0-M8, update to version v0.22.0-RC1.
For version 0.23.0-M1, update to version v0.23.0-RC1.
For versions 1.0.0-M1 through 1.0.0-M22, update to version v1.0.0-M23.
As a temporary workaround, avoid calling
StaticFile.fromUrl with non-file URLs.Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Http4S