CVE-2024-6759 NFS client accepts file names containing path separators
A malicious NFS server can trick clients into reading or writing files outside intended directories via unsanitized path separators in filenames.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6759?
CVE-2024-6759 is a medium-severity path traversal vulnerability in Freebsd Freebsd, published on 11 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, "/". This allows readdir(3) and related functions to return filesystem entries with names containing additional path components.
The lack of validation described above gives rise to a confused deputy problem. For example, a program copying files from an NFS mount could be tricked into copying from outside the intended source directory, and/or to a location outside the intended destination directory.
Weakness: CWE-22
Which versions are affected by CVE-2024-6759?
It affects 1 product.
Products include Freebsd Freebsd.
How do I fix CVE-2024-6759?
No fix has been published for CVE-2024-6759 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-6759 being exploited?
There is no known exploitation of CVE-2024-6759 in the wild and no public exploit code.
Other vulnerabilities in Freebsd Freebsd
Sources
Also known as GHSA-96rc-h8f4-67gc.