CVE-2021-43795 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in com.linecorp.armeria:armeria

What is CVE-2021-43795?

CVE-2021-43795 is a high-severity path traversal vulnerability in line armeria, published on 2 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path.

Weakness: CWE-22

Which versions are affected by CVE-2021-43795?

2 open source packages ship an affected version, including com.linecorp.armeria:armeria. It affects 1 product.

Products include Linecorp Armeria.

How do I fix CVE-2021-43795?

Upgrade com.linecorp.armeria:armeria to 1.13.4 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-43795 being exploited?

There is no known exploitation of CVE-2021-43795 in the wild and no public exploit code.

Other vulnerabilities in line armeria

• CVE-2024-1735 Armeria SAML authentication bypass due to missing validation on unsigned SAML messages Critical 9.1
• CVE-2023-38493 Paths contain matrix variables bypass decorators High 7.5
• CVE-2019-16771 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria Medium 4.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8fp4-rp6c-5gcv, ROOT-APP-MAVEN-CVE-2021-43795.