PT-2022-10888 · Spinnaker · Spinnaker

Jasonmcintosh · Published 2022-01-04 · Updated 2022-01-18 · CVE-2021-39143

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Spinnaker (affected versions not specified)

Description A path traversal vulnerability was discovered in Spinnaker's use of TAR files by AppEngine for deployments. This vulnerability allows an attacker to override files on the container, potentially introducing a Man-in-the-Middle (MITM) type attack vector by replacing libraries or injecting wrapper files. The issue arises because the utility used to extract files locally for deployment does not validate the paths in the deployment, which could lead to system files being overridden.

Recommendations For all affected versions, update Spinnaker as soon as possible. As a temporary workaround for users unable to update, consider disabling Google AppEngine deployments and/or disabling artifacts that provide TARs to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-39143

GHSA-34JX-3VMR-56V8

Affected Products

Spinnaker

References · 5

• 🔥 https://github.com/spinnaker/spinnaker/security/advisories/GHSA-34jx-3vmr-56v8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-39143 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39143 · Vendor Advisory
• https://t.me/cibsecurity/34947 · Telegram Post
• https://t.me/cvenotify/25580 · Telegram Post