CVE-2022-38179 JetBrains Ktor before 2.1.0 was vulnerable to a Reflect File Download attack

Medium 4.7 Published 12 Aug 2022 Updated 3 Aug 2024

Attackers can exploit a path traversal vulnerability in JetBrains Ktor to read arbitrary files from the server.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-38179?

CVE-2022-38179 is a medium-severity path traversal vulnerability in JetBrains Ktor, published on 12 Aug 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack

Weakness: CWE-697, CWE-184

Which versions are affected by CVE-2022-38179?

2 open source packages ship an affected version, including io.ktor:ktor. It affects 1 product.

Package	Affected	Fixed in
`io.ktor:ktor` Maven	All versions	`2.1.0`
`io.ktor:ktor` Maven	All versions	`2.1.0`

Products include Jetbrains Ktor.

How do I fix CVE-2022-38179?

Upgrade io.ktor:ktor to 2.1.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-38179 being exploited?

There is no known exploitation of CVE-2022-38179 in the wild and no public exploit code.

Sources

Also known as GHSA-v866-gwf5-w92f.