cnvd - cnvd-2021-103087

cnvd-2021-103087

Vulnerability from cnvd

Title: Armeria路径遍历漏洞

Description:

Armeria是一款用于构建使用HTTP/2作为会话层协议的异步微服务器的开源库。

Armeria存在路径遍历漏洞，该漏洞源于软件的路径验证逻辑存在问题。攻击者可以通过发送路径包含\%2F（编码为/）的 HTTP 请求，例如/files/..\%2Fsecrets.txt，访问其受限目录之外的 Armeria 服务器的本地文件系统，绕过 Armeria 的路径验证逻辑。

Severity: 中

Patch Name: Armeria路径遍历漏洞的补丁

Patch Description:

Armeria是一款用于构建使用HTTP/2作为会话层协议的异步微服务器的开源库。

Armeria存在路径遍历漏洞，该漏洞源于软件的路径验证逻辑存在问题。攻击者可以通过发送路径包含\%2F（编码为/）的 HTTP 请求，例如/files/..\%2Fsecrets.txt，访问其受限目录之外的 Armeria 服务器的本地文件系统，绕过 Armeria 的路径验证逻辑。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv

Reference: https://github.com/line/armeria/pull/3855

Impacted products

Name
Linecorp Armeria <1.13.4

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-43795",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-43795"
    }
  },
  "description": "Armeria\u662f\u4e00\u6b3e\u7528\u4e8e\u6784\u5efa\u4f7f\u7528HTTP/2\u4f5c\u4e3a\u4f1a\u8bdd\u5c42\u534f\u8bae\u7684\u5f02\u6b65\u5fae\u670d\u52a1\u5668\u7684\u5f00\u6e90\u5e93\u3002\n\nArmeria\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8f6f\u4ef6\u7684\u8def\u5f84\u9a8c\u8bc1\u903b\u8f91\u5b58\u5728\u95ee\u9898\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u53d1\u9001\u8def\u5f84\u5305\u542b\\%2F\uff08\u7f16\u7801\u4e3a/\uff09\u7684 HTTP \u8bf7\u6c42\uff0c\u4f8b\u5982/files/..\\%2Fsecrets.txt\uff0c\u8bbf\u95ee\u5176\u53d7\u9650\u76ee\u5f55\u4e4b\u5916\u7684 Armeria \u670d\u52a1\u5668\u7684\u672c\u5730\u6587\u4ef6\u7cfb\u7edf\uff0c \u7ed5\u8fc7 Armeria \u7684\u8def\u5f84\u9a8c\u8bc1\u903b\u8f91\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-103087",
  "openTime": "2021-12-29",
  "patchDescription": "Armeria\u662f\u4e00\u6b3e\u7528\u4e8e\u6784\u5efa\u4f7f\u7528HTTP/2\u4f5c\u4e3a\u4f1a\u8bdd\u5c42\u534f\u8bae\u7684\u5f02\u6b65\u5fae\u670d\u52a1\u5668\u7684\u5f00\u6e90\u5e93\u3002\r\n\r\nArmeria\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8f6f\u4ef6\u7684\u8def\u5f84\u9a8c\u8bc1\u903b\u8f91\u5b58\u5728\u95ee\u9898\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u53d1\u9001\u8def\u5f84\u5305\u542b\\%2F\uff08\u7f16\u7801\u4e3a/\uff09\u7684 HTTP \u8bf7\u6c42\uff0c\u4f8b\u5982/files/..\\%2Fsecrets.txt\uff0c\u8bbf\u95ee\u5176\u53d7\u9650\u76ee\u5f55\u4e4b\u5916\u7684 Armeria \u670d\u52a1\u5668\u7684\u672c\u5730\u6587\u4ef6\u7cfb\u7edf\uff0c \u7ed5\u8fc7 Armeria \u7684\u8def\u5f84\u9a8c\u8bc1\u903b\u8f91\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Armeria\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Linecorp Armeria \u003c1.13.4"
  },
  "referenceLink": "https://github.com/line/armeria/pull/3855",
  "serverity": "\u4e2d",
  "submitTime": "2021-12-04",
  "title": "Armeria\u8def\u5f84\u904d\u5386\u6f0f\u6d1e"
}

CVE-2021-43795 (GCVE-0-2021-43795)

Vulnerability from cvelistv5

Published

2021-12-02 18:00

Modified

2024-08-04 04:03

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Summary

Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path.

References

▼	URL	Tags
	https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv	x_refsource_CONFIRM
	https://github.com/line/armeria/pull/3855	x_refsource_MISC
	https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	line	armeria	Version: < 1.13.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T04:03:08.810Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/line/armeria/pull/3855"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "armeria",
          "vendor": "line",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.13.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server\u0027s local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria\u0027s path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-02T18:00:11",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/line/armeria/pull/3855"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284"
        }
      ],
      "source": {
        "advisory": "GHSA-8fp4-rp6c-5gcv",
        "discovery": "UNKNOWN"
      },
      "title": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) in com.linecorp.armeria:armeria",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-43795",
          "STATE": "PUBLIC",
          "TITLE": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) in com.linecorp.armeria:armeria"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "armeria",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 1.13.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "line"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server\u0027s local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria\u0027s path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv",
              "refsource": "CONFIRM",
              "url": "https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv"
            },
            {
              "name": "https://github.com/line/armeria/pull/3855",
              "refsource": "MISC",
              "url": "https://github.com/line/armeria/pull/3855"
            },
            {
              "name": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
              "refsource": "MISC",
              "url": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-8fp4-rp6c-5gcv",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-43795",
    "datePublished": "2021-12-02T18:00:11",
    "dateReserved": "2021-11-16T00:00:00",
    "dateUpdated": "2024-08-04T04:03:08.810Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted