GHSA-8fp4-rp6c-5gcv Path Traversal in com.linecorp.armeria:armeria

• Maven com.linecorp.armeria:armeria: >= 1.12.0, < 1.13.4 → fixed in 1.13.4

Impact An attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Patches Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. Workarounds This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path, e.g. ```java Server .builder() .serviceUnder( "/files", FileService .of(...) .decorate((delegate, ctx, req) -> { String path = req.headers().path(); if (path.contains("%2f") || path.contains("%2F")) { return HttpResponse.of(HttpStatus.BAD_REQUEST); } return delegate.serve(ctx, req); }) ) .build() ``` For more information If you have any questions or comments about this advisory: • Open an issue in line/armeria • Chat with us at Slack Credits This vulnerability was originally reported by Abdallah Zaher (elcayser-0x0a).