PT-2022-27789 · Unknown · Metersphere

Lujiefsi · Published 2022-12-29 · Updated 2023-01-05 · CVE-2022-46178

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions MeterSphere versions prior to 2.5.1

Description The issue allows users to upload a file without validating the file name, potentially leading to uploading files to any path if the file name in the upload request is falsified. This is due to a lack of validation in the FileUtils.java file, specifically in the createFile function, which does not check the filePath. The vulnerability has been fixed in version 2.5.1.

Recommendations For versions prior to 2.5.1, upgrade to version 2.5.1 to resolve the issue. As a temporary workaround, consider restricting file upload capabilities until the update can be applied. Avoid using the createFile function in FileUtils.java until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-46178

GHSA-9P62-X3C5-HR5P

Affected Products

Metersphere

References · 10

• 🔥 https://github.com/metersphere/metersphere/security/advisories/GHSA-9p62-x3c5-hr5p · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46178.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-46178 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46178 · Security Note
• https://osv.dev/vulnerability/GHSA-9p62-x3c5-hr5p · Vendor Advisory
• https://github.com/metersphere/metersphere · Note
• https://github.com/metersphere/metersphere/releases/tag/v2.5.1 · Note
• https://github.com/metersphere/metersphere/blob/v2.5.0/framework/sdk-parent/sdk/src/main/java/io/metersphere/commons/utils/FileUtils.java#L5 · Note
• https://t.me/cvenotify/41282 · Telegram Post
• https://t.me/cvenotify/40966 · Telegram Post