CVE-2021-41087 Improperly Implemented path matching for in-toto-golang
Authenticated attackers can bypass DISALLOW rules in in-toto-golang layouts using path traversal semantics in attestations, compromising supply chain integrity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41087?
CVE-2021-41087 is a medium-severity path traversal vulnerability in in-toto-golang, published on 21 Sep 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path traversal semantics (e.g., foo vs dir/../foo). Exploiting this vulnerability is dependent on the specific policy applied. The problem has been fixed in version 0.3.0.
Which versions are affected by CVE-2021-41087?
3 open source packages ship an affected version, including github.com/in-toto/in-toto-golang. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/in-toto/in-toto-golang Go | All versions | 0.3.0 |
github.com/in-toto/in-toto-golang Go | All versions | 0.3.0 |
github.com/in-toto/in-toto-golang Go | All versions | 0.3.0 |
Products include In-Toto In-Toto-Golang.
How do I fix CVE-2021-41087?
Upgrade github.com/in-toto/in-toto-golang to 0.3.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-41087 being exploited?
There is no known exploitation of CVE-2021-41087 in the wild and no public exploit code.
Sources
Also known as GHSA-vrxp-mg9f-hwf3, GO-2022-0936.