Medium, CVSS 6.1MavenPublished
Venice vulnerable to Partial Path Traversal issue within the functions load-file and load-resource
CVE-2022-36007 · GHSA-4mmh-5vw7-rgvj
- Affected
- Maven com.github.jlangch:venice <= 1.10.16
- Fixed in
- 1.10.17· Vendor fix available
- Issue
- Impact A partial path traversal issue exists within the functions load-file and load-resource. These functions can be limited to load files from a list of load paths. Assuming Venice has been configured with the load paths: [ "/Users/foo/resources" ] When passing relative paths to these two vulnerable functions everything is fine: (load-resource "test.png") = loads the file "/Users/foo/resources/test.png" (load-resource "../resources-alt/test.png") = rejected, outside the load path When passing absolute paths to these two vulnerable functions Venice may return files outside the configured load paths: (load-resource "/Users/foo/resources/test.png") = loads the file "/Users/foo/resources/test.png" (load-resource "/Users/foo/resources-alt/test.png") = loads the file "/Users/foo/resources-alt/test.png" !!! The latter call suffers from the Partial Path Traversal vulnerability. This issue’s scope is limited to absolute paths whose name prefix matches a load path. E.g. for a load-path…
Recommended action: Upgrade to 1.10.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.