CVE-2016-5725 Improper Limitation of a Pathname to a Restricted Directory in JCraft JSch
A malicious SFTP server can write arbitrary files on Windows clients using JSch in overwrite mode via directory traversal in recursive GET responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-5725?
CVE-2016-5725 is a medium-severity path traversal vulnerability in n/a, published on 19 Jan 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.
Weakness: CWE-22
Which versions are affected by CVE-2016-5725?
2 open source packages ship an affected version, including com.jcraft:jsch. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.jcraft:jsch Maven | All versions | 0.1.54 |
com.jcraft:jsch Maven | All versions | 0.1.54 |
Linux distribution packages (1)
jsch SUSE:Manager Server 3.0 | All versions | 0.1.54-3.1 |
Products include Jcraft Jsch.
How do I fix CVE-2016-5725?
Upgrade com.jcraft:jsch to 0.1.54 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2016-5725 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-5725 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as DEBIAN-CVE-2016-5725, DLA-2184-1, DLA-611-1, GHSA-q446-82vq-w674, MGASA-2016-0311, SUSE-SU-2017:0715-1.