CVE-2022-21221 - OpenCVE

The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Fasthttp Project	Fasthttp
Microsoft	Windows

Configuration 1 [-]

AND

cpe:2.3:a:fasthttp_project:fasthttp:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/valyala/fasthttp/commit/15262ecf3c602364639d465daba1e7f3604d00e8
https://github.com/valyala/fasthttp/commit/6b5bc7bb304975147b4af68df54ac214ed2554c1
https://github.com/valyala/fasthttp/issues/1226
https://github.com/valyala/fasthttp/releases/tag/v1.34.0
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866

History

No history.

MITRE

Status: PUBLISHED

Assigner: snyk

Published: 2022-03-17T11:21:09.487780Z

Updated: 2024-09-16T18:34:58.514Z

Reserved: 2022-02-24T00:00:00

Link: CVE-2022-21221

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-03-17T12:15:08.087

Modified: 2022-03-24T02:27:51.290

Link: CVE-2022-21221

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "github.com/valyala/fasthttp", "vendor": "n/a", "versions": [{"lessThan": "1.34.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "egovorukhin"}], "datePublic": "2022-03-17T00:00:00", "descriptions": [{"lang": "en", "value": "The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Directory Traversal", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-03-17T11:21:09", "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/valyala/fasthttp/issues/1226"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/valyala/fasthttp/commit/6b5bc7bb304975147b4af68df54ac214ed2554c1"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/valyala/fasthttp/commit/15262ecf3c602364639d465daba1e7f3604d00e8"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/valyala/fasthttp/releases/tag/v1.34.0"}], "title": "Directory Traversal", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "report@snyk.io", "DATE_PUBLIC": "2022-03-17T11:15:49.753937Z", "ID": "CVE-2022-21221", "STATE": "PUBLIC", "TITLE": "Directory Traversal"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "github.com/valyala/fasthttp", "version": {"version_data": [{"version_affected": "<", "version_value": "1.34.0"}]}}]}, "vendor_name": "n/a"}]}}, "credit": [{"lang": "eng", "value": "egovorukhin"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Directory Traversal"}]}]}, "references": {"reference_data": [{"name": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866", "refsource": "MISC", "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866"}, {"name": "https://github.com/valyala/fasthttp/issues/1226", "refsource": "MISC", "url": "https://github.com/valyala/fasthttp/issues/1226"}, {"name": "https://github.com/valyala/fasthttp/commit/6b5bc7bb304975147b4af68df54ac214ed2554c1", "refsource": "MISC", "url": "https://github.com/valyala/fasthttp/commit/6b5bc7bb304975147b4af68df54ac214ed2554c1"}, {"name": "https://github.com/valyala/fasthttp/commit/15262ecf3c602364639d465daba1e7f3604d00e8", "refsource": "MISC", "url": "https://github.com/valyala/fasthttp/commit/15262ecf3c602364639d465daba1e7f3604d00e8"}, {"name": "https://github.com/valyala/fasthttp/releases/tag/v1.34.0", "refsource": "MISC", "url": "https://github.com/valyala/fasthttp/releases/tag/v1.34.0"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T02:31:59.051Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/valyala/fasthttp/issues/1226"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/valyala/fasthttp/commit/6b5bc7bb304975147b4af68df54ac214ed2554c1"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/valyala/fasthttp/commit/15262ecf3c602364639d465daba1e7f3604d00e8"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/valyala/fasthttp/releases/tag/v1.34.0"}]}]}, "cveMetadata": {"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "assignerShortName": "snyk", "cveId": "CVE-2022-21221", "datePublished": "2022-03-17T11:21:09.487780Z", "dateReserved": "2022-02-24T00:00:00", "dateUpdated": "2024-09-16T18:34:58.514Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fasthttp_project:fasthttp:*:*:*:*:*:*:*:*", "matchCriteriaId": "B292937C-1EF2-4FD3-B714-90714DEC82E1", "versionEndExcluding": "1.34.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only."}, {"lang": "es", "value": "El paquete github.com/valyala/fasthttp versiones anteriores a 1.34.0, es vulnerable a un Salto de Directorio por medio de la funci\u00f3n ServeFile, debido a un saneo inapropiado. Puede explotarse usando un car\u00e1cter de barra invertida %5c en la ruta. **Nota:** Este problema de seguridad afecta \u00fanicamente a usuarios de Windows"}], "id": "CVE-2022-21221", "lastModified": "2022-03-24T02:27:51.290", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "report@snyk.io", "type": "Secondary"}]}, "published": "2022-03-17T12:15:08.087", "references": [{"source": "report@snyk.io", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/valyala/fasthttp/commit/15262ecf3c602364639d465daba1e7f3604d00e8"}, {"source": "report@snyk.io", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/valyala/fasthttp/commit/6b5bc7bb304975147b4af68df54ac214ed2554c1"}, {"source": "report@snyk.io", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/valyala/fasthttp/issues/1226"}, {"source": "report@snyk.io", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/valyala/fasthttp/releases/tag/v1.34.0"}, {"source": "report@snyk.io", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866"}], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}