PT-2024-26903 · Unknown · Reposilite
Artsploit
·
Published
2024-06-19
·
Updated
2024-12-19
·
CVE-2024-36117
CVSS v4.0
8.8
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Reposilite versions 3.5.10 through 3.5.11
Description
The issue is related to an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. This occurs because the
GET /javadoc/{repository}/<gav>/raw/<resource> route uses the <resource> path parameter to find the file in the javadocUnpackPath directory and returns its content to the user. The <resource> path parameter can contain path traversal characters, allowing an attacker to read files outside the javadocUnpackPath directory. This may lead to the exposure of sensitive information, including passwords and hashes of issued tokens stored in the reposilite.db file or other sensitive properties in the configuration.cdn file.Recommendations
For versions 3.5.10 through 3.5.11, update to version 3.5.12 to resolve the issue.
As a temporary workaround, consider normalizing the
<resource> path parameter by removing all occurrences of /../ before using it to read the file. This can be achieved by changing resource.toString() to resource.toPath() in the JavadocFacade.kt file.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Reposilite