Vulnerability-Lookup

GHSA-2CCP-VQMV-4R4X

Vulnerability from github – Published: 2025-02-03 17:56 – Updated: 2025-02-04 17:17

Summary

S3Proxy allows insecure path traversal in filesystem and filesystem-nio2 storage backends

Details

Impact

Users of the filesystem and filesystem-nio2 storage backends could unintentionally expose local files to authenticated clients.

Patches

Upgrade to S3Proxy 2.6.0 which includes apache/jclouds@b0819e0ef5e08c792a4d1724b938714ce9503aa3 and 86b6ee4749aa163a78e7898efc063617ed171980.

Workarounds

None

References

Privately reported by XBOW Team @xbow-security.

Severity ?

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.gaul:s3proxy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-24961"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-03T17:56:03Z",
    "nvd_published_at": "2025-02-03T21:15:16Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nUsers of the filesystem and filesystem-nio2 storage backends could unintentionally expose local files to authenticated clients.\n\n### Patches\nUpgrade to S3Proxy 2.6.0 which includes apache/jclouds@b0819e0ef5e08c792a4d1724b938714ce9503aa3 and 86b6ee4749aa163a78e7898efc063617ed171980.\n\n### Workarounds\nNone\n\n### References\nPrivately reported by XBOW Team @xbow-security.",
  "id": "GHSA-2ccp-vqmv-4r4x",
  "modified": "2025-02-04T17:17:49Z",
  "published": "2025-02-03T17:56:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gaul/s3proxy/security/advisories/GHSA-2ccp-vqmv-4r4x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24961"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/jclouds/commit/b0819e0ef5e08c792a4d1724b938714ce9503aa3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gaul/s3proxy/commit/86b6ee4749aa163a78e7898efc063617ed171980"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gaul/s3proxy"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "S3Proxy allows insecure path traversal in filesystem and filesystem-nio2 storage backends"
}

CVE-2025-24961 (GCVE-0-2025-24961)

Vulnerability from cvelistv5 – Published: 2025-02-03 20:29 – Updated: 2025-02-12 20:51

Title

Insecure path traversal in filesystem and filesystem-nio2 storage backends in org.gaul S3Proxy

Summary

org.gaul S3Proxy implements the S3 API and proxies requests. Users of the filesystem and filesystem-nio2 storage backends could unintentionally expose local files to users. This issue has been addressed in version 2.6.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity ?

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/gaul/s3proxy/security/advisori…	x_refsource_CONFIRM
	https://github.com/apache/jclouds/commit/b0819e0e…	x_refsource_MISC
	https://github.com/gaul/s3proxy/commit/86b6ee4749…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gaul	s3proxy	Affected: < 2.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-24961",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-03T20:47:09.739109Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T20:51:25.069Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "s3proxy",
          "vendor": "gaul",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "org.gaul S3Proxy implements the S3 API and proxies requests. Users of the filesystem and filesystem-nio2 storage backends could unintentionally expose local files to users. This issue has been addressed in version 2.6.0. Users are advised to upgrade. There are no known workarounds for this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-03T20:29:17.885Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/gaul/s3proxy/security/advisories/GHSA-2ccp-vqmv-4r4x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/gaul/s3proxy/security/advisories/GHSA-2ccp-vqmv-4r4x"
        },
        {
          "name": "https://github.com/apache/jclouds/commit/b0819e0ef5e08c792a4d1724b938714ce9503aa3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apache/jclouds/commit/b0819e0ef5e08c792a4d1724b938714ce9503aa3"
        },
        {
          "name": "https://github.com/gaul/s3proxy/commit/86b6ee4749aa163a78e7898efc063617ed171980",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gaul/s3proxy/commit/86b6ee4749aa163a78e7898efc063617ed171980"
        }
      ],
      "source": {
        "advisory": "GHSA-2ccp-vqmv-4r4x",
        "discovery": "UNKNOWN"
      },
      "title": "Insecure path traversal in filesystem and filesystem-nio2 storage backends in org.gaul S3Proxy"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-24961",
    "datePublished": "2025-02-03T20:29:17.885Z",
    "dateReserved": "2025-01-29T15:18:03.209Z",
    "dateUpdated": "2025-02-12T20:51:25.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-2CCP-VQMV-4R4X

Impact

Patches

Workarounds

References

CVE-2025-24961 (GCVE-0-2025-24961)

Tags

Sightings

Nomenclature