CVE-2019-17572 Directory traversal in Apache RocketMQ
An attacker can create directories outside the intended path by sending a malicious topic name, potentially leading to unauthorized file system modifications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-17572?
CVE-2019-17572 is a medium-severity path traversal vulnerability in Apache RocketMQ, published on 14 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.
Weakness: CWE-22
Which versions are affected by CVE-2019-17572?
2 open source packages ship an affected version, including org.apache.rocketmq:rocketmq-broker. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.rocketmq:rocketmq-broker Maven | From 4.2.0 | 4.6.1 |
org.apache.rocketmq:rocketmq-broker Maven | From 4.2.0 | 4.6.1 |
Products include Apache Rocketmq.
How do I fix CVE-2019-17572?
Upgrade org.apache.rocketmq:rocketmq-broker to 4.6.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-17572 being exploited?
There is no known exploitation of CVE-2019-17572 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apache RocketMQ
Sources
Also known as GHSA-5x3v-2gxr-59m2.