GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GHSA-PX9H-X66R-8MPC

Vulnerability from github – Published: 2020-05-13 16:29 – Updated: 2021-08-25 21:08
VLAI
Summary
path traversal in Jooby
Details

Impact

Access to sensitive information available from classpath.

Patches

Patched version: 1.6.7 and 2.8.2

Commit 1.x: https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009

Commit 2.x: https://github.com/jooby-project/jooby/commit/c81479de67036993f406ccdec23990b44b0bec32

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

Latest 1.x version: 1.6.6

Arbitrary class path resource access 1

When sharing a File System directory as in:

assets("/static/**", Paths.get("static"));

The class path is also searched for the file (org.jooby.handlers.AssetHandler.loader): jooby/AssetHandler.java at 1.x · jooby-project/jooby · GitHub

  private static Loader loader(final Path basedir, final ClassLoader classloader) {
    if (Files.exists(basedir)) {
      return name -> {
        Path path = basedir.resolve(name).normalize();
        if (Files.exists(path) && path.startsWith(basedir)) {
          try {
            return path.toUri().toURL();
          } catch (MalformedURLException x) {
            // shh
          }
        }
        return classloader.getResource(name);
      };
    }
    return classloader::getResource;
  }

If we send /static/WEB-INF/web.xml it will fail to load it from the file system but will go into classloader.getResource(name) where name equals /WEB-INF/web.xml so will succeed and return the requested file. This way we can get any configuration file or even the application class files

If assets are configured for a certain extension we can still bypass it. eg:

assets("/static/**/*.js", Paths.get("static"));

We can send:

http://localhost:8080/static/io/yiss/App.class.js

Arbitrary class path resource access 2

This vulnerability also affects assets configured to access resources from the root of the class path. eg:

assets("/static/**");

In this case we can traverse static by sending:

http://localhost:8080/static/..%252fio/yiss/App.class

For more information

If you have any questions or comments about this advisory: * Open an issue in jooby * Email us at support@jooby.io

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.jooby:jooby"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jooby:jooby"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-7647"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-05-12T20:27:09Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\nAccess to sensitive information available from classpath. \n\n### Patches\nPatched version: 1.6.7 and 2.8.2\n\nCommit 1.x: https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009\n\nCommit 2.x: https://github.com/jooby-project/jooby/commit/c81479de67036993f406ccdec23990b44b0bec32\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n### References\n\nLatest 1.x version: 1.6.6\n\n#### Arbitrary class path resource access 1\nWhen sharing a *File System* directory as in:\n\n``` java\nassets(\"/static/**\", Paths.get(\"static\"));\n```\n\nThe class path is also searched for the file (`org.jooby.handlers.AssetHandler.loader`):\n[jooby/AssetHandler.java at 1.x \u00b7 jooby-project/jooby \u00b7 GitHub](https://github.com/jooby-project/jooby/blob/1.x/jooby/src/main/java/org/jooby/handlers/AssetHandler.java)\n\n``` java\n  private static Loader loader(final Path basedir, final ClassLoader classloader) {\n    if (Files.exists(basedir)) {\n      return name -\u003e {\n        Path path = basedir.resolve(name).normalize();\n        if (Files.exists(path) \u0026\u0026 path.startsWith(basedir)) {\n          try {\n            return path.toUri().toURL();\n          } catch (MalformedURLException x) {\n            // shh\n          }\n        }\n        return classloader.getResource(name);\n      };\n    }\n    return classloader::getResource;\n  }\n```\n\nIf we send `/static/WEB-INF/web.xml` it will fail to load it from the file system but will go into `classloader.getResource(name)` where name equals `/WEB-INF/web.xml` so will succeed and return the requested file. This way we can get any configuration file or even the application class files\n\nIf assets are configured for a certain extension we can still bypass it. eg:\n\n```java\nassets(\"/static/**/*.js\", Paths.get(\"static\"));\n```\n\nWe can send:\n\n```\nhttp://localhost:8080/static/io/yiss/App.class.js\n```\n\n#### Arbitrary class path resource access 2\nThis vulnerability also affects assets configured to access resources from the root of the class path. eg:\n\n```java\nassets(\"/static/**\");\n```\n\nIn this case we can traverse `static` by sending:\n\n```\nhttp://localhost:8080/static/..%252fio/yiss/App.class\n```\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [jooby](https://github.com/jooby-project/jooby/issues)\n* Email us at [support@jooby.io](mailto:support@jooby.io)",
  "id": "GHSA-px9h-x66r-8mpc",
  "modified": "2021-08-25T21:08:32Z",
  "published": "2020-05-13T16:29:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jooby-project/jooby/security/advisories/GHSA-px9h-x66r-8mpc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7647"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jooby-project/jooby"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JAVA-IOJOOBY-568806"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JAVA-IOJOOBY-568806,"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JAVA-ORGJOOBY-568807"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JAVA-ORGJOOBY-568807,"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "path traversal in Jooby"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.