GHSA-3jhm-87m6-x959 Path traversal mitigation bypass in OctoRPKI
An attacker can bypass path traversal filters in OctoRPKI to write files outside the cache directory by providing a malicious TAL file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-3jhm-87m6-x959?
GHSA-3jhm-87m6-x959 is a path traversal vulnerability in github.com/cloudflare/cfrpki, published on 25 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
The existing URI path filters in OctoRPKI (version < 1.4.3) mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder.
Specific Go Packages Affected
github.com/cloudflare/cfrpki/cmd/octorpki
Patches
The issue was fixed in version 1.4.3
References
Which versions are affected by GHSA-3jhm-87m6-x959?
3 open source packages ship an affected version, including github.com/cloudflare/cfrpki.
| Package | Affected | Fixed in |
|---|---|---|
github.com/cloudflare/cfrpki Go | All versions | 1.4.3 |
github.com/cloudflare/cfrpki Go | All versions | 1.4.3 |
github.com/cloudflare/cfrpki Go | All versions | 1.4.3 |
How do I fix GHSA-3jhm-87m6-x959?
Upgrade github.com/cloudflare/cfrpki to 1.4.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-3jhm-87m6-x959 being exploited?
There is no known exploitation of GHSA-3jhm-87m6-x959 in the wild and no public exploit code.
Sources
Also known as GO-2022-0496.