CWE-22
Allowed-with-ReviewImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Abstraction: Base · Status: Stable
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
13217 vulnerabilities reference this CWE, most recent first.
GHSA-GVV4-6J62-9QP9
Vulnerability from github – Published: 2022-05-17 02:42 – Updated: 2025-04-20 03:38Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to read arbitrary files via an absolute path traversal attack on sitecore/shell/download.aspx with the file parameter.
{
"affected": [],
"aliases": [
"CVE-2017-5966"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-23T05:29:00Z",
"severity": "MODERATE"
},
"details": "Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to read arbitrary files via an absolute path traversal attack on sitecore/shell/download.aspx with the file parameter.",
"id": "GHSA-gvv4-6j62-9qp9",
"modified": "2025-04-20T03:38:11Z",
"published": "2022-05-17T02:42:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5966"
},
{
"type": "WEB",
"url": "http://research.aurainfosec.io/disclosures/2017-05-18-sitecore"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GVVW-2FW3-Q5RV
Vulnerability from github – Published: 2022-05-14 02:45 – Updated: 2022-05-14 02:45Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to delete arbitrary files via the "docid" parameter when the mode is set to delete.
{
"affected": [],
"aliases": [
"CVE-2018-15141"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-13T18:29:00Z",
"severity": "MODERATE"
},
"details": "Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to delete arbitrary files via the \"docid\" parameter when the mode is set to delete.",
"id": "GHSA-gvvw-2fw3-q5rv",
"modified": "2022-05-14T02:45:26Z",
"published": "2022-05-14T02:45:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15141"
},
{
"type": "WEB",
"url": "https://github.com/openemr/openemr/pull/1765/files"
},
{
"type": "WEB",
"url": "https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/45202"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GW25-CPW2-G3M4
Vulnerability from github – Published: 2022-04-29 03:00 – Updated: 2022-04-29 03:00Directory traversal vulnerability in Aldo's Web Server (aweb) 1.5 allows remote attackers to view arbitrary files via a .. (dot dot) in an HTTP GET request.
{
"affected": [],
"aliases": [
"CVE-2004-1991"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2004-05-03T04:00:00Z",
"severity": "MODERATE"
},
"details": "Directory traversal vulnerability in Aldo\u0027s Web Server (aweb) 1.5 allows remote attackers to view arbitrary files via a .. (dot dot) in an HTTP GET request.",
"id": "GHSA-gw25-cpw2-g3m4",
"modified": "2022-04-29T03:00:35Z",
"published": "2022-04-29T03:00:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-1991"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16048"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=108360629031227\u0026w=2"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/11542"
},
{
"type": "WEB",
"url": "http://www.oliverkarow.de/research/AldosWebserverMultipleVulns.txt"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/5881"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/10262"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GW42-F939-FHVM
Vulnerability from github – Published: 2023-05-23 19:54 – Updated: 2025-10-22 19:20An important security issue affects a range of versions of Openfire, the cross-platform real-time collaboration server based on the XMPP protocol that is created by the Ignite Realtime community.
Impact
Openfire's administrative console (the Admin Console), a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users.
Cause
Path traversal protections were already in place to protect against exactly this kind of attack, but didn’t defend against certain non-standard URL encoding for UTF-16 characters, that were not supported by the embedded webserver that was in use at the time.
A later upgrade of the embedded webserver included support for non-standard URL encoding of UTF-16 characters. The path traversal protections in place in Openfire were not updated to include protection against this new encoding.
Openfire's API defines a mechanism for certain URLs to be excluded from web authentication (this, for example, is used for the login page). This mechanism allows for wildcards to be used, to allow for flexible URL pattern matching.
The combination of the wildcard pattern matching and path traversal vulnerability allows a malicious user to bypass authentication requirements for Admin Console pages.
Affected versions
This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0).
Problem Reproduction
To test if an instance of Openfire is affected, follow these steps. Open a browser in incognito mode, or otherwise ensure that there is no authenticated session with the Openfire admin console. Open the following URL (possibly modified for the hostname of the server that is running Openfire):
http://localhost:9090/setup/setup-s/%u002e%u002e/%u002e%u002e/log.jsp
If this shows part of the openfire logfiles, then the instance of Openfire is affected by this vulnerability. Note that different versions of Openfire will show a different layout. Newer versions of Openfire can be expected to show log files on a dark background, while older versions will show a largely white page. (Depending on the content of the log file, this page might be empty, apart from a header!)
If there's a redirect to the login page, the instance is likely unaffected.
Problem Resolution
The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0).
- In Openfire 4.6.8, 4.7.5 and 4.8.0, Path Traversal pattern detection has been improved to include detection of non-standard URL encodings, preventing any non UTF-8 characters.
- In Openfire 4.6.8, 4.7.5 and 4.8.0, a new configuration property (
adminConsole.access.allow-wildcards-in-excludes) is introduced that controls the permissibility of using wildcards in URL-patterns that define exclusions to authentication. - In Openfire 4.6.8, 4.7.5 and 4.8.0, the existing value that uses a wildcard in URL-patterns that define exclusions to authentication has been replaced by values that do not depend on a wildcard.
- In Openfire 4.6.8, 4.7.5 and 4.8.0, Setup-specific URL-patterns that define exclusions to authentication are no longer active after the setup process has finished.
- In Openfire 4.8.0, the embedded webserver will be updated to a version that no longer supports the non-standard URL encoding of UTF-16 characters.
- In Openfire 4.8.0, the embedded webserver that serves the Openfire administrative console will bind to the loopback network interface by default.
Be aware that the new configuration properties can interfere with the functionality of certain Openfire plugins. This is especially true for plugins that bind a (web)endpoint to the embedded webserver that serves the Openfire administrative console, like current versions of the REST API plugin do. For these plugins to remain functional and/or reachable, it might be required to toggle the property adminConsole.access.allow-wildcards-in-excludes to true, and to avoid binding the embedded webserver to the loopback network interface only.
When your server uses older versions of the following plugins, make sure to upgrade them:
- Random Avatar plugin, update to version 1.1.0 or later.
- Monitoring Service plugin, update to version 2.5.0 or later.
- HTTP File Upload plugin, update to version 1.3.0 or later.
Mitigation
If an Openfire upgrade isn’t available for your release, or isn’t quickly actionable, you can take any of the following steps to mitigate the risk for your Openfire environment.
Be aware: through Openfire plugins, the effectiveness of some mitigations listed below can be reduced, while other mitigations might affect the functionality of plugins. Particular care should be taken when using the Monitoring Service plugin, REST API plugin, User Service plugin and/or Random Avatar plugin.
Restrict network access
Use network security measures (network ACLs and/or firewalls, VPNs) to ensure only trusted members of your community have access to the Openfire Admin Console. As a general rule, never expose the Openfire Admin Console to the general internet.
Examples:
* On a linux machine running ufw, deny ports 9090 and 9091 on non-loopback interfaces
* On a Windows machine, restrict the rules that open ports 9090 and 9091 to only allow traffic from the IPv4 and/or IPv6 loopback addresses
* On AWS cloud infrastructure, use EC2 Security Groups to restrict ports 9090 and 9091 to trusted IP addresses. If the trusted range is necessarily too broad, consider opening and closing the ports only as necessary
* If using Docker, instead of docker run ... -p 5222:5222 -p 9090:9090 -p 9091:9091 openfire prevent remote access to the Admin Console with docker run ... -p 5222:5222 -p 127.0.0.1:9090:9090 -p 127.0.0.1:9091:9091 openfire
Modify runtime configuration file
To close the avenue of potential attack, a runtime configuration file of Openfire can be modified.
In Openfire's installation directory, find the file plugins/admin/webapp/WEB-INF/web.xml. After creating a backup of this file, edit the original file.
The content of this file is XML. Find a <filter> element, that contains the <filter-name>AuthCheck</filter-name> child element. Depending on your version of Openfire, it will look similar to this:
<filter>
<filter-name>AuthCheck</filter-name>
<filter-class>org.jivesoftware.admin.AuthCheckFilter</filter-class>
<init-param>
<param-name>excludes</param-name>
<param-value>
login.jsp,index.jsp?logout=true,setup/index.jsp,setup/setup-*,.gif,.png,error-serverdown.jsp,loginToken.jsp
</param-value>
</init-param>
</filter>
The value inside of the param-value element is a comma-separated list of values. From this list, remove all * (asterisk) characters.
Save the file, and restart Openfire for the change to take effect.
Note that no guarantees can be given that this runtime configuration change persists over time. Ensure to monitor the presence of the fix. It is recommended to upgrade to a safe version of Openfire as soon as possible.
A side-effect of this change is that the Openfire web-based setup wizard will not function properly (functionality can be restored by reverting the change). This wizard is typically used only when initially installing Openfire.
Bind admin console to loopback interface
The Openfire admin console is a web-based application. By default, the corresponding webserver (that is embedded in Openfire) binds to all network interfaces of the host that it is running on.
The admin console can be configured to bind to a specific network interface. This will prevent it from being accessed through other network interfaces. By configuring the admin console to bind to the local loopback interface, it is accessible only to users on the server itself. This reduces the avenue of attack.
Note that several Openfire plugins expose part or all of their functionality through the admin console webserver. The REST API plugin, for example, serves its endpoints via this webserver. Availability of this functionality will be affected by binding the webserver to a specific network interface.
To bind the webserver of the Openfire admin console to a specific network interface, the 'openfire.xml' configuration file can be used.
In Openfire's installation directory, locate the file conf/openfire.xml. After creating a backup of this file, edit the original file.
The content of this file is XML. Find the <adminConsole> element that is a direct child element of the root <jive> element. Add a new element, named <interface> as a child element of <adminConsole>. The value of the <interface> element should be the name of the loopback interface or interface address. Setting value to 127.0.0.1 works on all tested environments (using values like lo on most Linux systems or lo0 on macOS will have the same effect).
The resulting fragment of the openfire.xml file will look similar to this:
<?xml version="1.0" encoding="UTF-8"?>
<jive>
<adminConsole>
<interface>127.0.0.1</interface>
<port>9090</port>
<securePort>9091</securePort>
</adminConsole>
...
Save the file, and restart Openfire for the change to take effect.
Use AuthFilterSanitizer plugin
The Ignite Realtime community has made available a new plugin, called the AuthFilterSanitizer plugin. The plugin can be installed from the Openfire admin console, or can be downloaded from the plugin's archive page on the IgniteRealtime.org community website.
This plugin periodically removes entries for Openfire's authentication filter that are susceptible to abuse, closing the avenue of potential attack.
Note that this plugin might interfere with functionality that depends on the abuse-susceptible entries in the authentication filter that might be provided by plugins.
Credit
This issue was originally reported by Siebene@ who has our gratitude for the responsible and detailed disclosure of the issue!
We are grateful for the resources made available by Surevine ltd. They were instrumental in addressing the issue listed in this advisory.
References
- Ignite Realtime community site
- Openfire releases download page
- Openfire AuthFilter Sanitizer plugin releases download page
- Openfire HTTP File Upload plugin releases download page
- Openfire Monitoring Service plugin releases download page
- Openfire Random Avatar plugin releases download page
- OWASP: Path Traversal
- Wikipedia: URL encoding, section 'Non-standard implementations'
- Issue OF-2595 in Openfire's issue tracker
- Jetty CVE-2021-34429
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.igniterealtime.openfire:xmppserver"
},
"ranges": [
{
"events": [
{
"introduced": "3.10.0"
},
{
"fixed": "4.6.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.igniterealtime.openfire:xmppserver"
},
"ranges": [
{
"events": [
{
"introduced": "4.7.0"
},
{
"fixed": "4.7.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-32315"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2023-05-23T19:54:30Z",
"nvd_published_at": "2023-05-26T23:15:16Z",
"severity": "HIGH"
},
"details": "An important security issue affects a range of versions of Openfire, the cross-platform real-time collaboration server based on the XMPP protocol that is created by the Ignite Realtime community. \n\n### Impact\nOpenfire\u0027s administrative console (the Admin Console), a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users.\n\n### Cause\nPath traversal protections were already in place to protect against exactly this kind of attack, but didn\u2019t defend against certain non-standard URL encoding for UTF-16 characters, that were not supported by the embedded webserver that was in use at the time.\n\nA later upgrade of the embedded webserver included support for non-standard URL encoding of UTF-16 characters. The path traversal protections in place in Openfire were not updated to include protection against this new encoding. \n\nOpenfire\u0027s API defines a mechanism for certain URLs to be excluded from web authentication (this, for example, is used for the login page). This mechanism allows for wildcards to be used, to allow for flexible URL pattern matching.\n\nThe combination of the wildcard pattern matching and path traversal vulnerability allows a malicious user to bypass authentication requirements for Admin Console pages.\n\n### Affected versions\nThis vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0).\n\n### Problem Reproduction\nTo test if an instance of Openfire is affected, follow these steps. Open a browser in incognito mode, or otherwise ensure that there is no authenticated session with the Openfire admin console. Open the following URL (possibly modified for the hostname of the server that is running Openfire):\n\n```http://localhost:9090/setup/setup-s/%u002e%u002e/%u002e%u002e/log.jsp```\n\nIf this shows part of the openfire logfiles, then the instance of Openfire is affected by this vulnerability. Note that different versions of Openfire will show a different layout. Newer versions of Openfire can be expected to show log files on a dark background, while older versions will show a largely white page. (Depending on the content of the log file, this page might be empty, apart from a header!)\n\nIf there\u0027s a redirect to the login page, the instance is likely unaffected.\n\n### Problem Resolution\nThe problem has been patched in [Openfire release 4.7.5 and 4.6.8](https://www.igniterealtime.org/downloads/#openfire), and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0).\n\n- In Openfire 4.6.8, 4.7.5 and 4.8.0, Path Traversal pattern detection has been improved to include detection of non-standard URL encodings, preventing any non UTF-8 characters.\n- In Openfire 4.6.8, 4.7.5 and 4.8.0, a new configuration property (`adminConsole.access.allow-wildcards-in-excludes`) is introduced that controls the permissibility of using wildcards in URL-patterns that define exclusions to authentication.\n- In Openfire 4.6.8, 4.7.5 and 4.8.0, the existing value that uses a wildcard in URL-patterns that define exclusions to authentication has been replaced by values that do not depend on a wildcard.\n- In Openfire 4.6.8, 4.7.5 and 4.8.0, Setup-specific URL-patterns that define exclusions to authentication are no longer active after the setup process has finished.\n- In Openfire 4.8.0, the embedded webserver will be updated to a version that no longer supports the non-standard URL encoding of UTF-16 characters.\n- In Openfire 4.8.0, the embedded webserver that serves the Openfire administrative console will bind to the loopback network interface by default.\n\nBe aware that the new configuration properties can interfere with the functionality of certain Openfire plugins. This is especially true for plugins that bind a (web)endpoint to the embedded webserver that serves the Openfire administrative console, like current versions of the REST API plugin do. For these plugins to remain functional and/or reachable, it might be required to toggle the property `adminConsole.access.allow-wildcards-in-excludes` to `true`, and to avoid binding the embedded webserver to the loopback network interface only.\n\nWhen your server uses older versions of the following plugins, make sure to upgrade them:\n\n- [Random Avatar plugin](https://www.igniterealtime.org/projects/openfire/plugin-archive.jsp?plugin=randomavatar), update to version 1.1.0 or later.\n- [Monitoring Service plugin](https://www.igniterealtime.org/projects/openfire/plugin-archive.jsp?plugin=monitoring), update to version 2.5.0 or later.\n- [HTTP File Upload plugin](https://www.igniterealtime.org/projects/openfire/plugin-archive.jsp?plugin=httpfileupload), update to version 1.3.0 or later.\n\n### Mitigation\nIf an Openfire upgrade isn\u2019t available for your release, or isn\u2019t quickly actionable, you can take any of the following steps to mitigate the risk for your Openfire environment.\n\nBe aware: through Openfire plugins, the effectiveness of some mitigations listed below can be reduced, while other mitigations might affect the functionality of plugins. Particular care should be taken when using the Monitoring Service plugin, REST API plugin, User Service plugin and/or Random Avatar plugin.\n\n#### Restrict network access\nUse network security measures (network ACLs and/or firewalls, VPNs) to ensure only trusted members of your community have access to the Openfire Admin Console. As a general rule, never expose the Openfire Admin Console to the general internet.\n\nExamples:\n* On a linux machine running `ufw`, deny ports 9090 and 9091 on non-loopback interfaces\n* On a Windows machine, restrict the rules that open ports 9090 and 9091 to only allow traffic from the IPv4 and/or IPv6 loopback addresses\n* On AWS cloud infrastructure, use EC2 Security Groups to restrict ports 9090 and 9091 to trusted IP addresses. If the trusted range is necessarily too broad, consider opening and closing the ports only as necessary\n* If using Docker, instead of `docker run ... -p 5222:5222 -p 9090:9090 -p 9091:9091 openfire` prevent remote access to the Admin Console with `docker run ... -p 5222:5222 -p 127.0.0.1:9090:9090 -p 127.0.0.1:9091:9091 openfire`\n\n\n#### Modify runtime configuration file\nTo close the avenue of potential attack, a runtime configuration file of Openfire can be modified.\n\nIn Openfire\u0027s installation directory, find the file `plugins/admin/webapp/WEB-INF/web.xml`. After creating a backup of this file, edit the original file.\n\nThe content of this file is XML. Find a `\u003cfilter\u003e` element, that contains the `\u003cfilter-name\u003eAuthCheck\u003c/filter-name\u003e` child element. Depending on your version of Openfire, it will look similar to this:\n\n```xml\n\u003cfilter\u003e\n \u003cfilter-name\u003eAuthCheck\u003c/filter-name\u003e\n \u003cfilter-class\u003eorg.jivesoftware.admin.AuthCheckFilter\u003c/filter-class\u003e\n \u003cinit-param\u003e\n \u003cparam-name\u003eexcludes\u003c/param-name\u003e\n \u003cparam-value\u003e\n login.jsp,index.jsp?logout=true,setup/index.jsp,setup/setup-*,.gif,.png,error-serverdown.jsp,loginToken.jsp\n \u003c/param-value\u003e\n \u003c/init-param\u003e\n\u003c/filter\u003e\n```\nThe value inside of the `param-value` element is a comma-separated list of values. From this list, remove all `*` (asterisk) characters.\n\nSave the file, and restart Openfire for the change to take effect.\n\nNote that no guarantees can be given that this runtime configuration change persists over time. Ensure to monitor the presence of the fix. It is recommended to upgrade to a safe version of Openfire as soon as possible.\n\nA side-effect of this change is that the Openfire web-based setup wizard will not function properly (functionality can be restored by reverting the change). This wizard is typically used only when initially installing Openfire.\n\n#### Bind admin console to loopback interface\nThe Openfire admin console is a web-based application. By default, the corresponding webserver (that is embedded in Openfire) binds to all network interfaces of the host that it is running on.\n\nThe admin console can be configured to bind to a specific network interface. This will prevent it from being accessed through other network interfaces. By configuring the admin console to bind to the local loopback interface, it is accessible only to users on the server itself. This reduces the avenue of attack.\n\nNote that several Openfire plugins expose part or all of their functionality through the admin console webserver. The REST API plugin, for example, serves its endpoints via this webserver. Availability of this functionality will be affected by binding the webserver to a specific network interface.\n\nTo bind the webserver of the Openfire admin console to a specific network interface, the \u0027openfire.xml\u0027 configuration file can be used.\n\nIn Openfire\u0027s installation directory, locate the file `conf/openfire.xml`. After creating a backup of this file, edit the original file.\n\nThe content of this file is XML. Find the `\u003cadminConsole\u003e` element that is a direct child element of the root `\u003cjive\u003e` element. Add a new element, named `\u003cinterface\u003e` as a child element of `\u003cadminConsole\u003e`. The value of the `\u003cinterface\u003e` element should be the name of the loopback interface or interface address. Setting value to `127.0.0.1` works on all tested environments (using values like `lo` on most Linux systems or `lo0` on macOS will have the same effect).\n\nThe resulting fragment of the `openfire.xml` file will look similar to this:\n\n```xml\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003cjive\u003e\n \u003cadminConsole\u003e\n \u003cinterface\u003e127.0.0.1\u003c/interface\u003e\n \u003cport\u003e9090\u003c/port\u003e\n \u003csecurePort\u003e9091\u003c/securePort\u003e\n \u003c/adminConsole\u003e\n\n ...\n```\n\nSave the file, and restart Openfire for the change to take effect.\n\n#### Use AuthFilterSanitizer plugin\n\nThe Ignite Realtime community has made available a new plugin, called the AuthFilterSanitizer plugin. The plugin can be installed from the Openfire admin console, or can be downloaded from [the plugin\u0027s archive page](https://www.igniterealtime.org/projects/openfire/plugin-archive.jsp?plugin=authfiltersanitizer) on the IgniteRealtime.org community website.\n\nThis plugin periodically removes entries for Openfire\u0027s authentication filter that are susceptible to abuse, closing the avenue of potential attack.\n\nNote that this plugin might interfere with functionality that depends on the abuse-susceptible entries in the authentication filter that might be provided by plugins.\n\n### Credit\n\nThis issue was originally reported by Siebene@ who has our gratitude for the responsible and detailed disclosure of the issue! \n\nWe are grateful for the resources made available by Surevine ltd. They were instrumental in addressing the issue listed in this advisory.\n\n### References\n- [Ignite Realtime community site](https://www.igniterealtime.org/)\n- [Openfire releases download page](https://www.igniterealtime.org/downloads/#openfire)\n- [Openfire AuthFilter Sanitizer plugin releases download page](https://www.igniterealtime.org/projects/openfire/plugin-archive.jsp?plugin=authfiltersanitizer)\n- [Openfire HTTP File Upload plugin releases download page](https://www.igniterealtime.org/projects/openfire/plugin-archive.jsp?plugin=httpfileupload)\n- [Openfire Monitoring Service plugin releases download page](https://www.igniterealtime.org/projects/openfire/plugin-archive.jsp?plugin=monitoring)\n- [Openfire Random Avatar plugin releases download page](https://www.igniterealtime.org/projects/openfire/plugin-archive.jsp?plugin=randomavatar)\n- [OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n- [Wikipedia: URL encoding, section \u0027Non-standard implementations\u0027](https://en.wikipedia.org/wiki/URL_encoding#Non-standard_implementations)\n- [Issue OF-2595 in Openfire\u0027s issue tracker](https://igniterealtime.atlassian.net/browse/OF-2595)\n- [Jetty CVE-2021-34429](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34429)",
"id": "GHSA-gw42-f939-fhvm",
"modified": "2025-10-22T19:20:57Z",
"published": "2023-05-23T19:54:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/igniterealtime/Openfire/security/advisories/GHSA-gw42-f939-fhvm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32315"
},
{
"type": "WEB",
"url": "https://github.com/igniterealtime/Openfire/commit/2ac00a1ff42f5d3547ef58e21f8cdec992bfcf97"
},
{
"type": "WEB",
"url": "https://github.com/igniterealtime/Openfire/commit/71f3def2adeaac62729cf544b645c6819c3d9868"
},
{
"type": "WEB",
"url": "https://github.com/igniterealtime/Openfire/commit/a3b5ebd5032ff7be9d3ada5bf52bea2df96ec881"
},
{
"type": "PACKAGE",
"url": "https://github.com/igniterealtime/Openfire"
},
{
"type": "WEB",
"url": "https://github.com/igniterealtime/Openfire/releases/tag/v4.6.8"
},
{
"type": "WEB",
"url": "https://github.com/igniterealtime/Openfire/releases/tag/v4.7.5"
},
{
"type": "WEB",
"url": "https://igniterealtime.atlassian.net/browse/OF-2595"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-32315"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/173607/Openfire-Authentication-Bypass-Remote-Code-Execution.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:H",
"type": "CVSS_V3"
}
],
"summary": "Administration Console authentication bypass in openfire xmppserver"
}
GHSA-GW44-F6P9-QMM4
Vulnerability from github – Published: 2022-05-17 05:45 – Updated: 2022-05-17 05:45Directory traversal vulnerability in AFP Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote authenticated users to execute arbitrary code by creating files that are outside the bounds of a share.
{
"affected": [],
"aliases": [
"CVE-2010-1829"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-11-15T23:00:00Z",
"severity": "MODERATE"
},
"details": "Directory traversal vulnerability in AFP Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote authenticated users to execute arbitrary code by creating files that are outside the bounds of a share.",
"id": "GHSA-gw44-f6p9-qmm4",
"modified": "2022-05-17T05:45:34Z",
"published": "2022-05-17T05:45:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1829"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT4435"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1024723"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GW58-6F33-3447
Vulnerability from github – Published: 2022-05-24 19:12 – Updated: 2022-05-24 19:12A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP.
{
"affected": [],
"aliases": [
"CVE-2021-22704"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-02T17:15:00Z",
"severity": "CRITICAL"
},
"details": "A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP.",
"id": "GHSA-gw58-6f33-3447",
"modified": "2022-05-24T19:12:53Z",
"published": "2022-05-24T19:12:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22704"
},
{
"type": "WEB",
"url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GW89-6XRW-4CRF
Vulnerability from github – Published: 2022-05-17 02:41 – Updated: 2022-05-17 02:41Multiple directory traversal vulnerabilities in Samsung SyncThru 6 before 1.0 allow remote attackers to delete arbitrary files via unspecified parameters to (1) upload/updateDriver or (2) upload/addDriver or to execute arbitrary code with SYSTEM privileges via unspecified parameters to (3) uploadCloning.html, (4) fileupload.html, (5) uploadFirmware.html, or (6) upload/driver.
{
"affected": [],
"aliases": [
"CVE-2015-5473"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-01T16:29:00Z",
"severity": "CRITICAL"
},
"details": "Multiple directory traversal vulnerabilities in Samsung SyncThru 6 before 1.0 allow remote attackers to delete arbitrary files via unspecified parameters to (1) upload/updateDriver or (2) upload/addDriver or to execute arbitrary code with SYSTEM privileges via unspecified parameters to (3) uploadCloning.html, (4) fileupload.html, (5) uploadFirmware.html, or (6) upload/driver.",
"id": "GHSA-gw89-6xrw-4crf",
"modified": "2022-05-17T02:41:54Z",
"published": "2022-05-17T02:41:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5473"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/75912"
},
{
"type": "WEB",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-15-296"
},
{
"type": "WEB",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-15-297"
},
{
"type": "WEB",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-15-298"
},
{
"type": "WEB",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-15-299"
},
{
"type": "WEB",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-15-300"
},
{
"type": "WEB",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-15-301"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GW9Q-C7GH-J9VM
Vulnerability from github – Published: 2022-05-01 18:24 – Updated: 2025-01-17 15:32Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.
{
"affected": [],
"aliases": [
"CVE-2007-4559"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2007-08-28T01:17:00Z",
"severity": "MODERATE"
},
"details": "Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.",
"id": "GHSA-gw9q-c7gh-j9vm",
"modified": "2025-01-17T15:32:30Z",
"published": "2022-05-01T18:24:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4559"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=263261"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202309-06"
},
{
"type": "WEB",
"url": "http://mail.python.org/pipermail/python-dev/2007-August/074290.html"
},
{
"type": "WEB",
"url": "http://mail.python.org/pipermail/python-dev/2007-August/074292.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26623"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2007/3022"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GWCH-7M8V-7544
Vulnerability from github – Published: 2026-02-02 20:25 – Updated: 2026-02-04 21:58Note: It is uncertain whether this constitutes a vulnerability or should be filed as an issue instead.
Summary
In the SSH configuration documentation, the sudoer line that was suggested can be escalated to edit any files in the system.
Details
The following line were suggested for addition in the sudoers file:
terraform ALL=(root) NOPASSWD: /usr/bin/tee /var/lib/vz/*
But this is highly insecure as the folder can be escaped using ../ and any files can be edited on the system.
PoC
Using a terraform user with the previously mentioned line in the /etc/sudoers file, a /etc/sudoers.d/sudo file can be added using this command:
echo "ALL=(ALL) NOPASSWD:ALL" | tee /var/lib/vz/../../../etc/sudoers.d/sudo
This grants access to the full root of the node.
Impact
This breaches the access limits of the Terraform user.
Suggested workaround
Use a strict regex on the command to allow only the names that should be pushed by this user.
Example for cloudinit yaml files:
terraform ALL=(root) NOPASSWD: /usr/bin/tee /var/lib/vz/snippets/[A-Za-z0-9-]*\\.yaml
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/bpg/terraform-provider-proxmox"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.93.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-25499"
],
"database_specific": {
"cwe_ids": [
"CWE-1188",
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-02T20:25:53Z",
"nvd_published_at": "2026-02-04T21:16:01Z",
"severity": "HIGH"
},
"details": "\u003e Note: It is uncertain whether this constitutes a vulnerability or should be filed as an issue instead.\n\n### Summary\n\nIn the SSH configuration documentation, the sudoer line that was suggested can be escalated to edit any files in the system.\n\n### Details\n\nThe following line were suggested for addition in the sudoers file:\n\n```bash\nterraform ALL=(root) NOPASSWD: /usr/bin/tee /var/lib/vz/*\n```\n\nBut this is highly insecure as the folder can be escaped using `../` and any files can be edited on the system.\n\n### PoC\n\nUsing a `terraform` user with the previously mentioned line in the `/etc/sudoers` file, a `/etc/sudoers.d/sudo` file can be added using this command:\n\n`echo \"ALL=(ALL) NOPASSWD:ALL\" | tee /var/lib/vz/../../../etc/sudoers.d/sudo`\n\nThis grants access to the full root of the node.\n\n### Impact\n\nThis breaches the access limits of the Terraform user.\n\n### Suggested workaround\n\nUse a strict regex on the command to allow only the names that should be pushed by this user.\n\nExample for cloudinit yaml files:\n\n```bash\nterraform ALL=(root) NOPASSWD: /usr/bin/tee /var/lib/vz/snippets/[A-Za-z0-9-]*\\\\.yaml\n```",
"id": "GHSA-gwch-7m8v-7544",
"modified": "2026-02-04T21:58:25Z",
"published": "2026-02-02T20:25:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/bpg/terraform-provider-proxmox/security/advisories/GHSA-gwch-7m8v-7544"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25499"
},
{
"type": "WEB",
"url": "https://github.com/bpg/terraform-provider-proxmox/commit/bd604c41a31e2a55dd6acc01b0608be3ea49c023"
},
{
"type": "PACKAGE",
"url": "https://github.com/bpg/terraform-provider-proxmox"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "terraform-provider-proxmox has insecure sudo recommendation in the documentation"
}
GHSA-GWCV-H9VC-HVGH
Vulnerability from github – Published: 2026-03-05 21:30 – Updated: 2026-03-10 21:32An unsafe parsing of OpenMQ's configuration, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved.
{
"affected": [],
"aliases": [
"CVE-2026-24457"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-05T19:16:02Z",
"severity": "CRITICAL"
},
"details": "An unsafe parsing of OpenMQ\u0027s configuration, allows a remote attacker to read arbitrary files from a MQ Broker\u0027s server. A full exploitation could read unauthorized files of the OpenMQ\u2019s host OS. In some scenarios RCE could be achieved.",
"id": "GHSA-gwcv-h9vc-hvgh",
"modified": "2026-03-10T21:32:11Z",
"published": "2026-03-05T21:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24457"
},
{
"type": "WEB",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/84"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5.1
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434.
- Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would be removed from the original string, but the remaining characters would still form the "../" string.
Mitigation MIT-15
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation MIT-20.1
Strategy: Input Validation
- Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
- Use a built-in path canonicalization function (such as realpath() in C) that produces the canonical version of the pathname, which effectively removes ".." sequences and symbolic links (CWE-23, CWE-59). This includes:
- realpath() in C
- getCanonicalPath() in Java
- GetFullPath() in ASP.NET
- realpath() or abs_path() in Perl
- realpath() in PHP
Mitigation MIT-4
Strategy: Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Mitigation MIT-29
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Mitigation MIT-21.1
Strategy: Enforcement by Conversion
- When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
- For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-185] provide this capability.
Mitigation MIT-22
Strategy: Sandbox or Jail
- Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
- OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-34
Strategy: Attack Surface Reduction
- Store library, include, and utility files outside of the web document root, if possible. Otherwise, store them in a separate directory and use the web server's access control capabilities to prevent attackers from directly requesting them. One common practice is to define a fixed constant in each calling program, then check for the existence of the constant in the library/include file; if the constant does not exist, then the file was directly requested, and it can exit immediately.
- This significantly reduces the chance of an attacker being able to bypass any protection mechanisms that are in the base program but not in the include files. It will also reduce the attack surface.
Mitigation MIT-39
- Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
- If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
- Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
- In the context of path traversal, error messages which disclose path information can help attackers craft the appropriate attack strings to move through the file system hierarchy.
Mitigation MIT-16
Strategy: Environment Hardening
When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.
CAPEC-126: Path Traversal
An adversary uses path manipulation methods to exploit insufficient input validation of a target to obtain access to data that should be not be retrievable by ordinary well-formed requests. A typical variety of this attack involves specifying a path to a desired file together with dot-dot-slash characters, resulting in the file access API or function traversing out of the intended directory structure and into the root file system. By replacing or modifying the expected path information the access function or API retrieves the file desired by the attacker. These attacks either involve the attacker providing a complete path to a targeted file or using control characters (e.g. path separators (/ or \) and/or dots (.)) to reach desired directories or files.
CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic
This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple ways of encoding a URL and abuse the interpretation of the URL. A URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
CAPEC-78: Using Escaped Slashes in Alternate Encoding
This attack targets the use of the backslash in alternate encoding. An adversary can provide a backslash as a leading character and causes a parser to believe that the next character is special. This is called an escape. By using that trick, the adversary tries to exploit alternate ways to encode the same character which leads to filter problems and opens avenues to attack.
CAPEC-79: Using Slashes in Alternate Encoding
This attack targets the encoding of the Slash characters. An adversary would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the adversary many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other.