github - ghsa-hwv5-w8gm-fq9f

GHSA-HWV5-W8GM-FQ9F

Vulnerability from github – Published: 2020-10-06 18:21 – Updated: 2024-11-19 18:08

Summary

Directory Traversal vulnerability in GET/PUT allows attackers to Disclose Information or Write Files via a crafted GET/PUT request

Details

Impact

Information Disclosure

When the GET method is attacked, attackers can read files which have a .data suffix and which are accompanied by a JSON file with the .meta suffix. This can lead to Information Disclosure and in some shared-hosting scenarios also to circumvention of authentication or other limitations on the outbound (GET) traffic.

For example, in a scenario where a single server has multiple instances of the application running (with separate DATA_ROOT settings), an attacker who has knowledge about the directory structure is able to read files from any other instance to which the process has read access.

If instances have individual authentication (for example, HTTP authentication via a reverse proxy, source IP based filtering) or other restrictions (such as quotas), attackers may circumvent those limits in such a scenario by using the Directory Traversal to retrieve data from the other instances.

File Write

If the associated XMPP server (or anyone knowing the SECRET_KEY) is malicious, they can write files outside the DATA_ROOT. The files which are written are constrained to have the .meta and the .data suffixes; the .meta file will contain the JSON with the Content-Type of the original request and the .data file will contain the payload.

Patches

PR #12 fixes the issue. The PR has been merged into version 0.4.0 and 0.4.0 has been released and pushed to PyPI. Users are advised to upgrade immediately.

Workarounds

Apache can apparently be configured to filter such malicious paths when reverse-proxying.
There are no other workarounds known.

References

Pull Request #12

Severity ?

3.5 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

2.3 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "xmpp-http-upload"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-15239"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-10-06T18:20:50Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Impact\n\n#### Information Disclosure\n\nWhen the GET method is attacked, attackers can read files which have a `.data` suffix and which are accompanied by a JSON file with the `.meta` suffix. This can lead to Information Disclosure and in some shared-hosting scenarios also to circumvention of authentication or other limitations on the outbound (GET) traffic.\n\nFor example, in a scenario where a single server has multiple instances of the application running (with separate DATA_ROOT settings), an attacker who has knowledge about the directory structure is able to read files from any other instance to which the process has read access.\n\nIf instances have individual authentication (for example, HTTP authentication via a reverse proxy, source IP based filtering) or other restrictions (such as quotas), attackers may circumvent those limits in such a scenario by using the Directory Traversal to retrieve data from the other instances.\n\n#### File Write\n\nIf the associated XMPP server (or anyone knowing the SECRET_KEY) is malicious, they can write files outside the DATA_ROOT. The files which are written are constrained to have the `.meta` and the `.data` suffixes; the `.meta` file will contain the JSON with the Content-Type of the original request and the `.data` file will contain the payload.\n\n### Patches\n\nPR #12 fixes the issue. The PR has been merged into version 0.4.0 and 0.4.0 has been released and pushed to PyPI. Users are advised to upgrade immediately.\n\n### Workarounds\n\n- Apache can apparently be configured to filter such malicious paths when reverse-proxying. \n- There are no other workarounds known.\n\n### References\n\n- [Pull Request #12](https://github.com/horazont/xmpp-http-upload/pull/12)",
  "id": "GHSA-hwv5-w8gm-fq9f",
  "modified": "2024-11-19T18:08:50Z",
  "published": "2020-10-06T18:21:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/horazont/xmpp-http-upload/security/advisories/GHSA-hwv5-w8gm-fq9f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15239"
    },
    {
      "type": "WEB",
      "url": "https://github.com/horazont/xmpp-http-upload/pull/12"
    },
    {
      "type": "WEB",
      "url": "https://github.com/horazont/xmpp-http-upload/commit/82056540191e89f0cd697c81f57714c00962ed75"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/horazont/xmpp-http-upload"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/xmpp-http-upload/PYSEC-2020-158.yaml"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/xmpp-http-upload/#history"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Directory Traversal vulnerability in GET/PUT allows attackers to Disclose Information or Write Files via a crafted GET/PUT request"
}

PYSEC-2020-158

Vulnerability from pysec - Published: 2020-10-06 19:15 - Updated: 2020-10-23 03:09

Details

In xmpp-http-upload before version 0.4.0, when the GET method is attacked, attackers can read files which have a .data suffix and which are accompanied by a JSON file with the .meta suffix. This can lead to Information Disclosure and in some shared-hosting scenarios also to circumvention of authentication or other limitations on the outbound (GET) traffic. For example, in a scenario where a single server has multiple instances of the application running (with separate DATA_ROOT settings), an attacker who has knowledge about the directory structure is able to read files from any other instance to which the process has read access. If instances have individual authentication (for example, HTTP authentication via a reverse proxy, source IP based filtering) or other restrictions (such as quotas), attackers may circumvent those limits in such a scenario by using the Directory Traversal to retrieve data from the other instances. If the associated XMPP server (or anyone knowing the SECRET_KEY) is malicious, they can write files outside the DATA_ROOT. The files which are written are constrained to have the .meta and the .data suffixes; the .meta file will contain the JSON with the Content-Type of the original request and the .data file will contain the payload. The issue is patched in version 0.4.0.

Impacted products

Name	purl
xmpp-http-upload	pkg:pypi/xmpp-http-upload

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "xmpp-http-upload",
        "purl": "pkg:pypi/xmpp-http-upload"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "82056540191e89f0cd697c81f57714c00962ed75"
            }
          ],
          "repo": "https://github.com/horazont/xmpp-http-upload",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1",
        "0.2.0",
        "0.3.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2020-15239",
    "GHSA-hwv5-w8gm-fq9f"
  ],
  "details": "In xmpp-http-upload before version 0.4.0, when the GET method is attacked, attackers can read files which have a `.data` suffix and which are accompanied by a JSON file with the `.meta` suffix. This can lead to Information Disclosure and in some shared-hosting scenarios also to circumvention of authentication or other limitations on the outbound (GET) traffic. For example, in a scenario where a single server has multiple instances of the application running (with separate DATA_ROOT settings), an attacker who has knowledge about the directory structure is able to read files from any other instance to which the process has read access. If instances have individual authentication (for example, HTTP authentication via a reverse proxy, source IP based filtering) or other restrictions (such as quotas), attackers may circumvent those limits in such a scenario by using the Directory Traversal to retrieve data from the other instances. If the associated XMPP server (or anyone knowing the SECRET_KEY) is malicious, they can write files outside the DATA_ROOT. The files which are written are constrained to have the `.meta` and the `.data` suffixes; the `.meta` file will contain the JSON with the Content-Type of the original request and the `.data` file will contain the payload. The issue is patched in version 0.4.0.",
  "id": "PYSEC-2020-158",
  "modified": "2020-10-23T03:09:00Z",
  "published": "2020-10-06T19:15:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/horazont/xmpp-http-upload/security/advisories/GHSA-hwv5-w8gm-fq9f"
    },
    {
      "type": "FIX",
      "url": "https://github.com/horazont/xmpp-http-upload/commit/82056540191e89f0cd697c81f57714c00962ed75"
    },
    {
      "type": "WEB",
      "url": "https://github.com/horazont/xmpp-http-upload/pull/12"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/xmpp-http-upload/#history"
    }
  ]
}

CVE-2020-15239 (GCVE-0-2020-15239)

Vulnerability from cvelistv5 – Published: 2020-10-06 18:30 – Updated: 2024-08-04 13:08

Summary

In xmpp-http-upload before version 0.4.0, when the GET method is attacked, attackers can read files which have a `.data` suffix and which are accompanied by a JSON file with the `.meta` suffix. This can lead to Information Disclosure and in some shared-hosting scenarios also to circumvention of authentication or other limitations on the outbound (GET) traffic. For example, in a scenario where a single server has multiple instances of the application running (with separate DATA_ROOT settings), an attacker who has knowledge about the directory structure is able to read files from any other instance to which the process has read access. If instances have individual authentication (for example, HTTP authentication via a reverse proxy, source IP based filtering) or other restrictions (such as quotas), attackers may circumvent those limits in such a scenario by using the Directory Traversal to retrieve data from the other instances. If the associated XMPP server (or anyone knowing the SECRET_KEY) is malicious, they can write files outside the DATA_ROOT. The files which are written are constrained to have the `.meta` and the `.data` suffixes; the `.meta` file will contain the JSON with the Content-Type of the original request and the `.data` file will contain the payload. The issue is patched in version 0.4.0.

Severity ?

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

CWE

CWE-22 - {"CWE-22":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}

Assigner

GitHub_M

References

URL

Tags

	https://github.com/horazont/xmpp-http-upload/secu…	x_refsource_CONFIRM
	https://github.com/horazont/xmpp-http-upload/pull/12	x_refsource_MISC
	https://github.com/horazont/xmpp-http-upload/comm…	x_refsource_MISC
	https://pypi.org/project/xmpp-http-upload/#history	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	horazont	xmpp-http-upload	Affected: < 0.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:08:23.202Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/horazont/xmpp-http-upload/security/advisories/GHSA-hwv5-w8gm-fq9f"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/horazont/xmpp-http-upload/pull/12"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/horazont/xmpp-http-upload/commit/82056540191e89f0cd697c81f57714c00962ed75"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://pypi.org/project/xmpp-http-upload/#history"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "xmpp-http-upload",
          "vendor": "horazont",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In xmpp-http-upload before version 0.4.0, when the GET method is attacked, attackers can read files which have a `.data` suffix and which are accompanied by a JSON file with the `.meta` suffix. This can lead to Information Disclosure and in some shared-hosting scenarios also to circumvention of authentication or other limitations on the outbound (GET) traffic. For example, in a scenario where a single server has multiple instances of the application running (with separate DATA_ROOT settings), an attacker who has knowledge about the directory structure is able to read files from any other instance to which the process has read access. If instances have individual authentication (for example, HTTP authentication via a reverse proxy, source IP based filtering) or other restrictions (such as quotas), attackers may circumvent those limits in such a scenario by using the Directory Traversal to retrieve data from the other instances. If the associated XMPP server (or anyone knowing the SECRET_KEY) is malicious, they can write files outside the DATA_ROOT. The files which are written are constrained to have the `.meta` and the `.data` suffixes; the `.meta` file will contain the JSON with the Content-Type of the original request and the `.data` file will contain the payload. The issue is patched in version 0.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "{\"CWE-22\":\"Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-06T18:30:15",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/horazont/xmpp-http-upload/security/advisories/GHSA-hwv5-w8gm-fq9f"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/horazont/xmpp-http-upload/pull/12"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/horazont/xmpp-http-upload/commit/82056540191e89f0cd697c81f57714c00962ed75"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://pypi.org/project/xmpp-http-upload/#history"
        }
      ],
      "source": {
        "advisory": "GHSA-hwv5-w8gm-fq9f",
        "discovery": "UNKNOWN"
      },
      "title": "Directory Traversal in xmpp-http-upload",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15239",
          "STATE": "PUBLIC",
          "TITLE": "Directory Traversal in xmpp-http-upload"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "xmpp-http-upload",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 0.4.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "horazont"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In xmpp-http-upload before version 0.4.0, when the GET method is attacked, attackers can read files which have a `.data` suffix and which are accompanied by a JSON file with the `.meta` suffix. This can lead to Information Disclosure and in some shared-hosting scenarios also to circumvention of authentication or other limitations on the outbound (GET) traffic. For example, in a scenario where a single server has multiple instances of the application running (with separate DATA_ROOT settings), an attacker who has knowledge about the directory structure is able to read files from any other instance to which the process has read access. If instances have individual authentication (for example, HTTP authentication via a reverse proxy, source IP based filtering) or other restrictions (such as quotas), attackers may circumvent those limits in such a scenario by using the Directory Traversal to retrieve data from the other instances. If the associated XMPP server (or anyone knowing the SECRET_KEY) is malicious, they can write files outside the DATA_ROOT. The files which are written are constrained to have the `.meta` and the `.data` suffixes; the `.meta` file will contain the JSON with the Content-Type of the original request and the `.data` file will contain the payload. The issue is patched in version 0.4.0."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "{\"CWE-22\":\"Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/horazont/xmpp-http-upload/security/advisories/GHSA-hwv5-w8gm-fq9f",
              "refsource": "CONFIRM",
              "url": "https://github.com/horazont/xmpp-http-upload/security/advisories/GHSA-hwv5-w8gm-fq9f"
            },
            {
              "name": "https://github.com/horazont/xmpp-http-upload/pull/12",
              "refsource": "MISC",
              "url": "https://github.com/horazont/xmpp-http-upload/pull/12"
            },
            {
              "name": "https://github.com/horazont/xmpp-http-upload/commit/82056540191e89f0cd697c81f57714c00962ed75",
              "refsource": "MISC",
              "url": "https://github.com/horazont/xmpp-http-upload/commit/82056540191e89f0cd697c81f57714c00962ed75"
            },
            {
              "name": "https://pypi.org/project/xmpp-http-upload/#history",
              "refsource": "MISC",
              "url": "https://pypi.org/project/xmpp-http-upload/#history"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-hwv5-w8gm-fq9f",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-15239",
    "datePublished": "2020-10-06T18:30:15",
    "dateReserved": "2020-06-25T00:00:00",
    "dateUpdated": "2024-08-04T13:08:23.202Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-HWV5-W8GM-FQ9F

Impact

Information Disclosure

File Write

Patches

Workarounds

References

PYSEC-2020-158

CVE-2020-15239 (GCVE-0-2020-15239)

Tags

Sightings

Nomenclature