CVE-2020-36559 Path Traversal in aahframe.work
An attacker can read arbitrary files outside the target directory due to improper input sanitization in the aahframe.work Go library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-36559?
CVE-2020-36559 is a high-severity path traversal vulnerability in aahframe.work, published on 27 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
Weakness: CWE-22
Which versions are affected by CVE-2020-36559?
5 open source packages ship an affected version, including aahframe.work and github.com/go-aah/aah. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
aahframe.work Go | All versions | 0.12.4 |
aahframe.work Go | All versions | 0.12.4 |
aahframe.work Go | All versions | 0.12.4 |
github.com/go-aah/aah Go | All versions | 0.12.4 |
github.com/go-aah/aah Go | All versions | 0.12.4 |
Products include Aahframework Aah.
How do I fix CVE-2020-36559?
Upgrade aahframe.work to 0.12.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-36559 being exploited?
There is no known exploitation of CVE-2020-36559 in the wild and no public exploit code.
Sources
Also known as GHSA-vp56-r7qv-783v, GO-2020-0033.