CVE-2016-10726: Directory Traversal Vulnerability in org.dspace:dspace-xmlui
Summary
CVE-2016-10726: High severity vulnerability that affects org.dspace:dspace-xmlui. Affects org.dspace:dspace-xmlui across 3 version ranges.
< 3.6
>= 4.0, < 4.5
>= 5.0, < 5.5
Fixed in 3.6, 4.5 or 5.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.dspace:dspace-xmlui is a Maven package that provides the XMLUI feature for DSpace, a digital repository software. XMLUI is a user interface for DSpace that allows users to interact with the repository through a web interface. This package is vulnerable to a directory traversal attack, which can be exploited to access files outside of the intended directory structure.
Vulnerability Detail
The vulnerability, identified as CVE-2016-10726, allows an attacker to perform directory traversal by manipulating the 'themes/' path in the URI. By including two or more arbitrary characters and a colon before a pathname, an attacker can bypass the intended directory restrictions and access sensitive files on the server. This can lead to unauthorized disclosure of sensitive information or potential remote code execution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.63.6 -
>= 4.0, < 4.54.5 -
>= 5.0, < 5.55.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is recommended to implement input validation and sanitization to prevent the inclusion of arbitrary characters and colons in the 'themes/' path. This can be done by implementing proper input validation routines and filtering out any potentially malicious characters or sequences. Here is an example of how input validation can be implemented in Java:
String sanitizedPath = path.replaceAll("[^a-zA-Z0-9\\/]+", "");
This code snippet removes any characters that are not alphanumeric or forward slash from the 'path' variable, effectively preventing directory traversal attacks.
Conclusion
The directory traversal vulnerability in org.dspace:dspace-xmlui can lead to unauthorized access to sensitive files and potential remote code execution. It is crucial to upgrade to fixed versions (4.5 or 5.5) or later to mitigate this vulnerability. Implementing input validation and sanitization can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.dspace:dspace-xmlui →
FAQ
The vulnerability allows an attacker to access sensitive files on the server, potentially leading to unauthorized disclosure of information or remote code execution.
No, versions before 3.6, between 4.0 and 4.5, and between 5.0 and 5.5 are vulnerable. Versions 3.6, 4.5, and 5.5 or later have fixed this vulnerability.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
For more information about this vulnerability, you can refer to the GitHub advisory database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-4m9r-5gqp-7j82/GHSA-4m9r-5gqp-7j82.json
Related vulnerabilities
Recent vulnerabilities recorded for org.dspace:dspace-xmlui.
