CVE-2018-1000850 Directory Traversal vulnerability in Square Retrofit
Attackers can manipulate URL path parameters to add or delete resources via directory traversal in the Retrofit HTTP client library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000850?
CVE-2018-1000850 is a high-severity path traversal vulnerability in n/a, published on 20 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder class, method addPathParameter that can result in By manipulating the URL an attacker could add or delete resources otherwise unavailable to her.. This attack appear to be exploitable via An attacker should have access to an encoded path parameter on POST, PUT or DELETE request.. This vulnerability appears to have been fixed in 2.5.0 and later.
Weakness: CWE-22
Which versions are affected by CVE-2018-1000850?
2 open source packages ship an affected version, including com.squareup.retrofit2:retrofit. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.squareup.retrofit2:retrofit Maven | From 2.0.0 | 2.5.0 |
com.squareup.retrofit2:retrofit Maven | From 2.0.0 | 2.5.0 |
Products include Squareup Retrofit.
How do I fix CVE-2018-1000850?
Upgrade com.squareup.retrofit2:retrofit to 2.5.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-1000850 being exploited?
There is no known exploitation of CVE-2018-1000850 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-8p8g-f9vg-r7xr.