PT-2022-7281 · Apache+1 · Apache Ivy+1
Kostya Kortchinsky
·
Published
2022-11-07
·
Updated
2024-12-03
·
CVE-2022-37866
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Ivy versions 2.0.0 through 2.5.1
Description
The issue is related to the incorrect restriction of the directory path name in the Apache Ivy package manager. This can allow a remote attacker to gain unauthorized access to the file system. When Apache Ivy downloads artifacts from a repository, it stores them in the local file system based on a user-supplied pattern that may include placeholders for artifact coordinates. If these coordinates contain "../" sequences, it is possible for artifacts to be stored outside of Ivy's local cache or repository, or to overwrite different artifacts inside the local cache. To exploit this issue, an attacker needs collaboration from the remote repository, as Ivy will issue HTTP requests containing ".." sequences that a normal repository will not interpret as part of the artifact coordinates.
Recommendations
For Apache Ivy versions 2.0.0 through 2.5.1, upgrade to Ivy 2.5.1 to resolve the issue. As a temporary workaround, consider restricting the use of user-supplied patterns that may include "../" sequences in artifact coordinates until the upgrade is applied. Additionally, restrict access to the local cache or repository to minimize the risk of exploitation. Avoid using patterns that contain "../" sequences in the affected API endpoint until the issue is resolved.
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Ivy
Red Os