CVE-2021-43795 - Vulnerability Details - OpenCVE

Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Linecorp	Armeria

Configuration 1 [-]

cpe:2.3:a:linecorp:armeria:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284
https://github.com/line/armeria/pull/3855
https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2021-12-02T18:00:11

Updated: 2024-08-04T04:03:08.810Z

Reserved: 2021-11-16T00:00:00

Link: CVE-2021-43795

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-12-02T18:15:08.267

Modified: 2024-11-21T06:29:48.350

Link: CVE-2021-43795

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "armeria", "vendor": "line", "versions": [{"status": "affected", "version": "< 1.13.4"}]}], "descriptions": [{"lang": "en", "value": "Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-12-02T18:00:11", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/line/armeria/pull/3855"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284"}], "source": {"advisory": "GHSA-8fp4-rp6c-5gcv", "discovery": "UNKNOWN"}, "title": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in com.linecorp.armeria:armeria", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-43795", "STATE": "PUBLIC", "TITLE": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in com.linecorp.armeria:armeria"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "armeria", "version": {"version_data": [{"version_value": "< 1.13.4"}]}}]}, "vendor_name": "line"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}]}, "references": {"reference_data": [{"name": "https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv", "refsource": "CONFIRM", "url": "https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv"}, {"name": "https://github.com/line/armeria/pull/3855", "refsource": "MISC", "url": "https://github.com/line/armeria/pull/3855"}, {"name": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284", "refsource": "MISC", "url": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284"}]}, "source": {"advisory": "GHSA-8fp4-rp6c-5gcv", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T04:03:08.810Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/line/armeria/pull/3855"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-43795", "datePublished": "2021-12-02T18:00:11", "dateReserved": "2021-11-16T00:00:00", "dateUpdated": "2024-08-04T04:03:08.810Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linecorp:armeria:*:*:*:*:*:*:*:*", "matchCriteriaId": "1C4CC5EF-C8FD-41AB-A2C6-DA8D6E3ED2B6", "versionEndExcluding": "1.13.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path."}, {"lang": "es", "value": "Armeria es un framework de microservicios de c\u00f3digo abierto. En las versiones afectadas, un atacante puede acceder al sistema de archivos local de un servidor de Armeria m\u00e1s all\u00e1 de su directorio restringido mediante el env\u00edo de una petici\u00f3n HTTP cuya ruta contenga \"%2F\" (codificado \"/\"), como \"/files/..%2Fsecrets.txt\", omitiendo la l\u00f3gica de comprobaci\u00f3n de rutas de Armeria. Armeria versi\u00f3n 1.13.4 o superior, contiene una l\u00f3gica de comprobaci\u00f3n de rutas reforzada que maneja \"%2F\" apropiadamente. Esta vulnerabilidad puede solucionarse al insertar un decorador que lleve a cabo una comprobaci\u00f3n adicional en la ruta de petici\u00f3n"}], "id": "CVE-2021-43795", "lastModified": "2024-11-21T06:29:48.350", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2021-12-02T18:15:08.267", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/line/armeria/pull/3855"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/line/armeria/pull/3855"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}