CVE-2020-36565 Directory traversal on Windows in github.com/labstack/echo/v4
An attacker can read arbitrary files outside the intended directory on Windows systems using the Echo web framework's static file handler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-36565?
CVE-2020-36565 is a medium-severity path traversal vulnerability in github.com/labstack/echo/v4, published on 7 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
Weakness: CWE-22
Which versions are affected by CVE-2020-36565?
3 open source packages ship an affected version, including github.com/labstack/echo/v4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/labstack/echo/v4 Go | All versions | 4.1.18-0.20201215153152-4422e3b66b9f |
github.com/labstack/echo/v4 Go | All versions | 4.2.0 |
github.com/labstack/echo/v4 Go | All versions | 4.2.0 |
Products include Labstack Echo.
How do I fix CVE-2020-36565?
Upgrade github.com/labstack/echo/v4 to a fixed version for your release line: 4.1.18-0.20201215153152-4422e3b66b9f or 4.2.0.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-36565 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36565 exists.
Other vulnerabilities in github.com/labstack/echo/v4
Sources
Also known as GHSA-j453-hm5x-c46w, GO-2021-0051, UBUNTU-CVE-2020-36565.