CVE-2018-1261 Path traversal in org.springframework.integration:spring-integration-zip
Attackers can write arbitrary files outside the target directory via crafted archives, impacting applications using the Spring Integration Zip library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-1261?
CVE-2018-1261 is a medium-severity path traversal vulnerability in Pivotal Spring Integration Zip, published on 11 May 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z) that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.
Weakness: CWE-22
Which versions are affected by CVE-2018-1261?
2 open source packages ship an affected version, including org.springframework.integration:spring-integration-zip. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.integration:spring-integration-zip Maven | All versions | 1.0.1 |
org.springframework.integration:spring-integration-zip Maven | All versions | 1.0.1 |
Products include Vmware Spring Integration Zip.
How do I fix CVE-2018-1261?
Upgrade org.springframework.integration:spring-integration-zip to 1.0.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-1261 being exploited?
There is no known exploitation of CVE-2018-1261 in the wild and no public exploit code.
Other vulnerabilities in Pivotal Spring Integration Zip
Sources
Also known as GHSA-m9jm-rhrm-gcxj.