PT-2022-20574 · Amazon+1 · Aws Sdk For Java+1
Jlleitschuh
·
Published
2022-07-15
·
Updated
2024-12-10
·
CVE-2022-31159
CVSS v3.1
7.9
High
| Vector | AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
AWS SDK for Java versions prior to 1.12.261
Description
A partial-path traversal issue exists within the
downloadDirectory method in the AWS S3 TransferManager component of the AWS SDK for Java. This issue allows a knowledgeable actor to bypass the validation logic by including a UNIX double-dot in the bucket key, potentially permitting them to retrieve a directory from their S3 bucket that is one level up in the filesystem from their working directory. The scope of this issue is limited to directories whose name prefix matches the destinationDirectory. For example, for a destination directory /tmp/foo, the actor can cause a download to /tmp/foo-bar, but not /tmp/bar. If com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory is used to download an untrusted bucket's contents, the contents of that bucket can be written outside of the intended destination directory.Recommendations
For versions prior to 1.12.261, upgrade to version 1.12.261 or later to resolve the issue. As a temporary workaround, when calling
com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory, pass a KeyFilter that forbids S3ObjectSummary objects that getKey method return a string containing the substring ...Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Aws Sdk For Java
Bamboo