GitHub Advisoryadvisory · Go

GHSA-cqh2-vc2f-q4fh Arbitrary filepath traversal via URI injection

HIGH Published 2021-11-10 Modified 2021-11-10 Official page ↗
Aliases
CVE-2021-3907
Ecosystem
Go
Packages
github.com/cloudflare/cfrpki
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-20, CWE-22
Reviewed
2021-11-10

Affected packages

• Go github.com/cloudflare/cfrpki: < 1.4.4 → fixed in 1.4.4

Description

OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. `rsync://example.org/repo/../../etc/cron.daily/evil.roa`), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on. Patches For more information If you have any questions or comments about this advisory email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2021-3907 OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References