Vertx-web: [Security] Path Traversal In Windows

[LLfam]

Hi, I think there is a potential vul in io.vertx.ext.web.handler.StaticHandler.

Example code:
https://github.com/vert-x3/vertx-examples/blob/3.x/web-examples/src/main/java/io/vertx/example/web/staticsite/Server.java

Use PoC below will lead to Path Traversal in Windows
PoC:
http://ip:8080/%5c..%5cServer.java

%5c..%5c is a legitimate path for the URI spec. But in Handler, directly use it to find some resources is not security.

In io.vertx.ext.web.handler.impl.StaticHandlerImpl#handle, io.vertx.core.http.impl.HttpUtils#removeDots just sanitize /../ without considering \..\. So it will lead a Path Traversal in Windows.

[tmousaw-ptc]

Any chance that this will be backported to a 3.9.x patch release since this has a pretty high CVSS score per Sonatype?

[LLfam]

Hi, when I search CVE for this issue, i found CVE-2018-12542.
The vul I found is same as vul mentioned in issue#1025. This vul is fixed in Release 3.5.4. But Release 3.6.0+ is same as 3.5.3 that vul isn't fixed.
I don't know how it is caused.

[vietj]

yes it will be backported and released in 3.9.4

On Wed, Oct 7, 2020 at 3:49 PM tmousaw-ptc [e-mail] wrote:

Any chance that this will be backported to a 3.9.x patch release since
this has a pretty high CVSS score per Sonatype?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/vert-x3/vertx-web/issues/1714#issuecomment-704948719,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AABXDCVJHZISTV2T4L3VUPLSJRWWFANCNFSM4R2VLVAQ
.

[vietj]

This has been recorded as CVE-2019-17640