CVE-2018-1000817 Asset Pipeline Grails Plugin vulnerable to Path Traversal

What is CVE-2018-1000817?

CVE-2018-1000817 is a high-severity path traversal vulnerability in n/a, published on 20 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially crafted GET request containing directory traversal from assets-pipeline context. This vulnerability appears to have been fixed in 2.14.1.1 (for Grails 2.x), 2.15.1 (for Grails 3 and Java 7) and 3.0.6 (for Grails 3 and Java 8).

Weakness: CWE-22

Which versions are affected by CVE-2018-1000817?

6 open source packages ship an affected version, including org.grails.plugins:asset-pipeline. It affects 1 product.

Products include Asset Pipeline Project Asset-Pipeline.

How do I fix CVE-2018-1000817?

Upgrade org.grails.plugins:asset-pipeline to a fixed version for your release line: 2.14.1, 2.15.1 or 3.0.6.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2018-1000817 being exploited?

There is no known exploitation of CVE-2018-1000817 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-17605 Asset Pipeline plugin for Grails vulnerable to Path Traversal High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w73q-mc9g-j56x.