Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a CVE vulnerability ID? 
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
New vulnerability? Tell us about it!
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2021-29425
Date: April 13, 2021
Overview
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\\\..\\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.Details
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\\\..\\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.PoC Details
Consider an application which gets a user provided file name, passes it to FilenameUtils.normalize, and then treats it as a sanitized file path.If the file is presumed to be created at an application accessible directory, the file could then be created one directory above it, where it should not be accessible by the application.
PoC Code
// An example of a vulnerable application:
import org.apache.commons.io.FilenameUtils;
import java.io.File;
public class vulnerableExample {
public static void main(String[] args) {
String fileName = FilenameUtils.normalize(args[0]); // args[0] == "/../<malicious file>"
File file = new File("/inaccessible/accessible" + fileName);
// New file created at /inaccessible/<fileName>
}
}Affected Environments
Apache Commons IO - 0.1 through 2.6Prevention
Upgrade to version commons-io:commons-io:2.7Language: Java
Good to know:
| Base Score: |
|
|---|---|
| Attack Vector (AV): | Network |
| Attack Complexity (AC): | High |
| Privileges Required (PR): | None |
| User Interaction (UI): | None |
| Scope (S): | Unchanged |
| Confidentiality (C): | Low |
| Integrity (I): | Low |
| Availability (A): | None |
| Base Score: |
|
|---|---|
| Access Vector (AV): | Network |
| Access Complexity (AC): | Medium |
| Authentication (AU): | None |
| Confidentiality (C): | Partial |
| Integrity (I): | Partial |
| Availability (A): | None |
| Additional information: |