CVE-2020-1745 Improper Authorization in Undertoe
Remote attackers can read web application files or execute code via file upload and inclusion in the Undertow AJP connector.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-1745?
CVE-2020-1745 is a high-severity path traversal vulnerability in undertow-io undertow, published on 28 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.
Weakness: CWE-285
Which versions are affected by CVE-2020-1745?
2 open source packages ship an affected version, including io.undertow:undertow-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.undertow:undertow-core Maven | All versions | 2.0.30 |
io.undertow:undertow-core Maven | All versions | 2.0.30 |
Linux distribution packages (3)
eap7-undertow Red Hat:jboss_enterprise_application_platform:7.2::el6 | All versions | 0:2.0.28-4.SP1_redhat_00002.1.el6eap |
eap7-undertow Red Hat:jboss_enterprise_application_platform:7.2::el7 | All versions | 0:2.0.28-4.SP1_redhat_00002.1.el7eap |
eap7-undertow Red Hat:jboss_enterprise_application_platform:7.2::el8 | All versions | 0:2.0.28-4.SP1_redhat_00002.1.el8eap |
Products include Redhat Undertow.
How do I fix CVE-2020-1745?
Upgrade io.undertow:undertow-core to 2.0.30 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-1745 being exploited?
There is no known exploitation of CVE-2020-1745 in the wild and no public exploit code.
Other vulnerabilities in undertow-io undertow
Sources
Also known as DEBIAN-CVE-2020-1745, GHSA-gv2w-88hx-8m9r, RHSA-2020:0813, UBUNTU-CVE-2020-1745.