Medium, CVSS 5.3PyPIAmendedPublished
xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern
GHSA-vj8v-p5vw-m6v5
- Affected
- PyPI xrootd < 5.9.2
- Fixed in
- 5.9.2· Vendor fix available
- Issue
- A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests. This bypass ignores the all.export restriction. Affected component src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in doDirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer. PoC Configuration - Configuration file: - Filesystem layout on the server: - Starting the server: xrootd -c /etc/xrootd/xrootd.cfg Steps to reproduce Normal behavior (access outside export is denied): Bypass via trailing ..: Also exploitable via HTTP PROPFIND: Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt). However, file download via this path traversal…
Recommended action: Upgrade to 5.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.