CVE-2014-7816 Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow

What is CVE-2014-7816?

CVE-2014-7816 is a medium-severity path traversal vulnerability in n/a, published on 1 Dec 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.

Weakness: CWE-22

Which versions are affected by CVE-2014-7816?

6 open source packages ship an affected version, including io.undertow:undertow-core. It affects 1 product.

Products include Redhat Undertow.

How do I fix CVE-2014-7816?

Upgrade io.undertow:undertow-core to a fixed version for your release line: 1.0.17, 1.1.0.CR5 or 1.2.0.Beta3.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2014-7816 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-7816 exists.

Public exploit code: 1 Metasploit module and 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2020-1745 Improper Authorization in Undertoe High 8.6
• CVE-2018-1114 Uncontrolled Resource Consumption in Undertow Medium 6.5
• CVE-2017-7559 Undertow vulnerable to Request Smuggling Medium 6.1
• CVE-2024-1459 Undertow: directory traversal vulnerability Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h6p6-fc4w-cqhx.