CVE-2022-37865 Apache Ivy allows creating/overwriting any file on the system
Attackers can overwrite arbitrary files on the system via malicious archives in Apache Ivy when using optional zip packaging features.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-37865?
CVE-2022-37865 is a critical path traversal vulnerability in Apache Ivy, published on 7 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the target path when extracting the archive. An archive containing absolute paths or paths that try to traverse "upwards" using ".." sequences can then write files to any location on the local fie system that the user executing Ivy has write access to. Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy 2.5.1.
Weakness: CWE-22
Which versions are affected by CVE-2022-37865?
2 open source packages ship an affected version, including org.apache.ivy:ivy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.ivy:ivy Maven | From 2.4.0 | 2.5.1 |
org.apache.ivy:ivy Maven | From 2.4.0 | 2.5.1 |
Products include Apache Ivy.
How do I fix CVE-2022-37865?
Upgrade org.apache.ivy:ivy to 2.5.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-37865 being exploited?
There is no known exploitation of CVE-2022-37865 in the wild and no public exploit code.
Other vulnerabilities in Apache Ivy
Sources
Also known as GHSA-94rr-4jr5-9h2p.