From efbe0df7cea1c9fe8161d732e0af12b0f4a1cf62 Mon Sep 17 00:00:00 2001 From: Jonathan Leitschuh Date: Fri, 29 Jul 2022 13:25:18 +0000 Subject: [PATCH] vuln-fix: Partial Path Traversal Vulnerability This fixes a partial path traversal vulnerability. Replaces `dir.getCanonicalPath().startsWith(parent.getCanonicalPath())`, which is vulnerable to partial path traversal attacks, with the more secure `dir.getCanonicalFile().toPath().startsWith(parent.getCanonicalFile().toPath())`. To demonstrate this vulnerability, consider `"/usr/outnot".startsWith("/usr/out")`. The check is bypassed although `/outnot` is not under the `/out` directory. It's important to understand that the terminating slash may be removed when using various `String` representations of the `File` object. For example, on Linux, `println(new File("/var"))` will print `/var`, but `println(new File("/var", "/")` will print `/var/`; however, `println(new File("/var", "/").getCanonicalPath())` will print `/var`. Weakness: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Severity: Medium CVSSS: 6.1 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.PartialPathTraversalVulnerability) Reported-by: Jonathan Leitschuh Signed-off-by: Jonathan Leitschuh Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/13 Co-authored-by: Moderne --- .../github/tomakehurst/wiremock/common/AbstractFileSource.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/main/java/com/github/tomakehurst/wiremock/common/AbstractFileSource.java b/src/main/java/com/github/tomakehurst/wiremock/common/AbstractFileSource.java index 20759ba250..e9f5be137e 100644 --- a/src/main/java/com/github/tomakehurst/wiremock/common/AbstractFileSource.java +++ b/src/main/java/com/github/tomakehurst/wiremock/common/AbstractFileSource.java @@ -27,6 +27,7 @@ import java.io.IOException; import java.net.URI; import java.nio.file.Path; +import java.nio.file.Paths; import java.util.List; public abstract class AbstractFileSource implements FileSource { @@ -159,7 +160,7 @@ private void assertFilePathIsUnderRoot(String path) { ? new File(path).getCanonicalPath() : new File(rootDirectory, path).getCanonicalPath(); - if (!filePath.startsWith(rootPath)) { + if (!Paths.get(filePath).normalize().startsWith(rootPath)) { throw new NotAuthorisedException("Access to file " + path + " is not permitted"); } } catch (IOException ioe) {