CVE-2020-15230 Arbitrary file read un Vapor
Attackers can read arbitrary files on the host if the application uses FileMiddleware, requiring an upgrade to the Vapor framework.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15230?
CVE-2020-15230 is a high-severity path traversal vulnerability in vapor, published on 2 Oct 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.
Weakness: CWE-22
Which versions are affected by CVE-2020-15230?
2 open source packages ship an affected version, including github.com/vapor/vapor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/vapor/vapor SwiftURL | From 4.0.0-rc.2.5 | 4.29.4 |
github.com/vapor/vapor SwiftURL | From 4.0.0-rc.2.5 | 4.29.4 |
Products include Vapor Project Vapor.
How do I fix CVE-2020-15230?
Upgrade github.com/vapor/vapor to 4.29.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-15230 being exploited?
There is no known exploitation of CVE-2020-15230 in the wild and no public exploit code.
Other vulnerabilities in vapor
Sources
Also known as GHSA-vcvg-xgr8-p5gq.