fkie_cve-2022-31159
Vulnerability from fkie_nvd
Published
2022-07-15 18:15
Modified
2024-11-21 07:04
Severity ?
7.9 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the `downloadDirectory` method in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. Applications using the SDK control the `destinationDirectory` argument, but S3 object keys are determined by the application that uploaded the objects. The `downloadDirectory` method allows the caller to pass a filesystem object in the object key but contained an issue in the validation logic for the key name. A knowledgeable actor could bypass the validation logic by including a UNIX double-dot in the bucket key. Under certain conditions, this could permit them to retrieve a directory from their S3 bucket that is one level up in the filesystem from their working directory. This issue’s scope is limited to directories whose name prefix matches the destinationDirectory. E.g. for destination directory`/tmp/foo`, the actor can cause a download to `/tmp/foo-bar`, but not `/tmp/bar`. If `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory` is used to download an untrusted buckets contents, the contents of that bucket can be written outside of the intended destination directory. Version 1.12.261 contains a patch for this issue. As a workaround, when calling `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory`, pass a `KeyFilter` that forbids `S3ObjectSummary` objects that `getKey` method return a string containing the substring `..` .
References
security-advisories@github.comhttps://github.com/aws/aws-sdk-java/security/advisories/GHSA-c28r-hw5m-5gv3Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/aws/aws-sdk-java/security/advisories/GHSA-c28r-hw5m-5gv3Exploit, Third Party Advisory
Impacted products
Vendor Product Version
amazon aws-sdk-java *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:amazon:aws-sdk-java:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "0C9116AD-5423-45EA-9577-EE801EEFA4D7",
                     versionEndIncluding: "1.12.260",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the `downloadDirectory` method in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. Applications using the SDK control the `destinationDirectory` argument, but S3 object keys are determined by the application that uploaded the objects. The `downloadDirectory` method allows the caller to pass a filesystem object in the object key but contained an issue in the validation logic for the key name. A knowledgeable actor could bypass the validation logic by including a UNIX double-dot in the bucket key. Under certain conditions, this could permit them to retrieve a directory from their S3 bucket that is one level up in the filesystem from their working directory. This issue’s scope is limited to directories whose name prefix matches the destinationDirectory. E.g. for destination directory`/tmp/foo`, the actor can cause a download to `/tmp/foo-bar`, but not `/tmp/bar`. If `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory` is used to download an untrusted buckets contents, the contents of that bucket can be written outside of the intended destination directory. Version 1.12.261 contains a patch for this issue. As a workaround, when calling `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory`, pass a `KeyFilter` that forbids `S3ObjectSummary` objects that `getKey` method return a string containing the substring `..` .",
      },
      {
         lang: "es",
         value: "El SDK de AWS para Java permite a desarrolladores de Java trabajar con Amazon Web Services. Se presenta un problema de salto de ruta parcial en el método \"downloadDirectory\" del componente AWS S3 TransferManager del AWS SDK para Java v1 versiones anteriores a 1.12.261. Las aplicaciones que usan el SDK controlan el argumento \"destinationDirectory\", pero las claves de los objetos de S3 están determinadas por la aplicación que cargó los objetos. El método \"downloadDirectory\" permite a quien lo llama pasar un objeto del sistema de archivos en la clave del objeto, pero contenía un problema en la lógica de comprobación del nombre de la clave. Un actor con conocimientos podía omitir la lógica de comprobación incluyendo un doble punto UNIX en la clave del cubo. Bajo determinadas condiciones, esto podría permitirles recuperar un directorio de su cubo de S3 que está un nivel más arriba en el sistema de archivos de su directorio de trabajo. El alcance de este problema es limitado a directorios cuyo prefijo de nombre coincide con el destinationDirectory. Por ejemplo, para el directorio de destino \"/tmp/foo\", el actor puede causar una descarga en \"/tmp/foo-bar\", pero no en \"/tmp/bar\". Si es usado \"com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory\" para descargar el contenido de un cubo no confiable, el contenido de ese cubo puede escribirse fuera del directorio de destino previsto. La versión 1.12.261 contiene un parche para este problema. Como mitigación, cuando llame a \"com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory\", pase un \"KeyFilter\" que prohíba los objetos \"S3ObjectSummary\" cuyo método \"getKey\" devuelva una cadena que contenga la subcadena \"..\" ",
      },
   ],
   id: "CVE-2022-31159",
   lastModified: "2024-11-21T07:04:01.497",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "LOW",
               baseScore: 7.9,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L",
               version: "3.1",
            },
            exploitabilityScore: 1.3,
            impactScore: 6,
            source: "security-advisories@github.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2022-07-15T18:15:09.037",
   references: [
      {
         source: "security-advisories@github.com",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://github.com/aws/aws-sdk-java/security/advisories/GHSA-c28r-hw5m-5gv3",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://github.com/aws/aws-sdk-java/security/advisories/GHSA-c28r-hw5m-5gv3",
      },
   ],
   sourceIdentifier: "security-advisories@github.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-22",
            },
         ],
         source: "security-advisories@github.com",
         type: "Primary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.