PT-2022-23026 · Sanic · Sanic

Highahopkins · Published 2022-08-01 · Updated 2022-08-10 · CVE-2022-35920

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Sanic versions prior to 20.12.7 Sanic versions prior to 21.12.2 Sanic versions prior to 22.6.1

Description The issue allows access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not impacted.

Recommendations For versions prior to 20.12.7, upgrade to version 20.12.7 or later. For versions prior to 21.12.2, upgrade to version 21.12.2 or later. For versions prior to 22.6.1, upgrade to version 22.6.1 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-35920

GHSA-8CW9-5HMV-77W6

Affected Products

Sanic

References · 10

• 🔥 https://github.com/sanic-org/sanic/issues/2478 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35920.json · Exploit
• https://github.com/sanic-org/sanic/pull/2495 · Patch
• https://osv.dev/vulnerability/CVE-2022-35920 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8cw9-5hmv-77w6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35920 · Security Note
• https://github.com/sanic-org/sanic · Note
• https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6 · Note
• https://t.me/cibsecurity/47393 · Telegram Post
• https://t.me/cvenotify/34497 · Telegram Post