CVE-2021-44138 Path Traversal in Caucho Resin

What is CVE-2021-44138?

CVE-2021-44138 is a high-severity path traversal vulnerability in n/a, published on 4 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request.

Weakness: CWE-22

Which versions are affected by CVE-2021-44138?

2 open source packages ship an affected version, including com.caucho:resin. It affects 1 product.

Products include Caucho Resin.

How do I fix CVE-2021-44138?

No fix has been published for CVE-2021-44138 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-44138 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-44138 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in n/a

• CVE-2012-2965 Caucho Quercus, as distributed in Resin, does not properly handle unspecified characters in the names of variables High 7.5
• CVE-2012-2966 Caucho Quercus, as distributed in Resin, overwrites entries in SERVER superglobal array on basis of POST parameters High 7.5
• CVE-2012-2967 Caucho Quercus, as distributed in Resin, does not properly implement the `==` operator for comparisons High 7.5
• CVE-2012-2969 Path traversal in n/a Medium 6.4
• CVE-2014-2966 Security feature bypass in n/a Medium 5.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4w2q-9hp2-vxj5.