CVE-2021-23772 Arbitrary File Write
Attackers can write files to arbitrary locations via unsafe filename handling in the Iris Go web framework's upload method.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-23772?
CVE-2021-23772 is a high-severity path traversal vulnerability in github.com/kataras/iris, published on 24 Dec 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.
Weakness: CWE-59
Which versions are affected by CVE-2021-23772?
6 open source packages ship an affected version, including github.com/kataras/iris and github.com/kataras/iris/v12. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kataras/iris Go | All versions | None |
github.com/kataras/iris Go | All versions to 0.0.2 | None |
github.com/kataras/iris Go | All versions to 0.0.2 | None |
github.com/kataras/iris/v12 Go | All versions | 12.2.0-alpha8 |
github.com/kataras/iris/v12 Go | All versions | 12.2.0-alpha8 |
github.com/kataras/iris/v12 Go | All versions | 12.2.0-alpha8 |
Products include Iris-Go Iris.
How do I fix CVE-2021-23772?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-23772 being exploited?
There is no known exploitation of CVE-2021-23772 in the wild and no public exploit code.
Sources
Also known as GHSA-jcxc-rh6w-wf49, GO-2022-0272.