CVE-2022-37866 Apache Ivy allows path traversal in the presence of a malicious repository
Attackers can write files outside the cache or overwrite artifacts via malicious repository coordinates, requiring repository collaboration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-37866?
CVE-2022-37866 is a high-severity path traversal vulnerability in Apache Ivy, published on 7 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain "../" sequences - which are valid characters for Ivy coordinates in general - it is possible the artifacts are stored outside of Ivy's local cache or repository or can overwrite different artifacts inside of the local cache. In order to exploit this vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests containing ".." sequences and a "normal" repository will not interpret them as part of the artifact coordinates. Users of Apache Ivy 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1.
Weakness: CWE-22
Which versions are affected by CVE-2022-37866?
2 open source packages ship an affected version, including org.apache.ivy:ivy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.ivy:ivy Maven | From 2.0.0 | 2.5.1 |
org.apache.ivy:ivy Maven | From 2.0.0 | 2.5.1 |
Products include Apache Ivy.
How do I fix CVE-2022-37866?
Upgrade org.apache.ivy:ivy to 2.5.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-37866 being exploited?
There is no known exploitation of CVE-2022-37866 in the wild and no public exploit code.
Other vulnerabilities in Apache Ivy
Sources
Also known as GHSA-wv7w-rj2x-556x.