CVE-2018-17605 Asset Pipeline plugin for Grails vulnerable to Path Traversal
Attackers can perform directory traversal in Grails applications using the Asset Pipeline plugin on Jetty, potentially reading arbitrary files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-17605?
CVE-2018-17605 is a high-severity path traversal vulnerability in n/a, published on 28 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in AssetPipelineFilter.groovy or AssetPipelineFilterCore.groovy.
Weakness: CWE-22
Which versions are affected by CVE-2018-17605?
2 open source packages ship an affected version, including org.grails.plugins:asset-pipeline. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.grails.plugins:asset-pipeline Maven | All versions | 3.0.4 |
org.grails.plugins:asset-pipeline Maven | All versions | 3.0.4 |
Products include Asset Pipeline Project Asset-Pipeline.
How do I fix CVE-2018-17605?
Upgrade org.grails.plugins:asset-pipeline to 3.0.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-17605 being exploited?
There is no known exploitation of CVE-2018-17605 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-g7wm-22m6-5774.