CVE-2018-10862: Improper Limitation of a Pathname to a Restricted Directory in WildFly

Background

WildFly Core is a Java-based application server that provides a runtime environment for Java applications. It offers features such as clustering, load balancing, and management capabilities. The WildFly Core package, specifically the 'wildfly-server' component, is affected by a vulnerability that allows for the extraction of crafted .war archives to overwrite arbitrary files. This vulnerability is known as 'Zip Slip' and can lead to unauthorized access, data loss, or the execution of arbitrary code.

Vulnerability Detail

The vulnerability in WildFly Core arises from the improper validation of file paths in .war archives. Attackers can exploit this flaw by creating a specially crafted .war archive that contains file paths with '../' sequences. When the archive is extracted, these sequences can traverse directories and overwrite arbitrary files outside the intended extraction directory. This can result in the modification or deletion of critical system files, leading to a compromise of the server's integrity and confidentiality. The 'Zip Slip' vulnerability is a well-known issue in archive extraction libraries and can have severe consequences if not addressed.

Workaround

As a temporary workaround, users can implement a file path validation mechanism during the extraction of .war archives. This mechanism should check for any '../' sequences in the extracted file paths and reject or sanitize them to prevent directory traversal. Here is an example of a Java code snippet that demonstrates this workaround:

import java.nio.file.Path;
import java.nio.file.Paths;

public class WarArchiveExtractor {
  public static void extractWarArchive(String archivePath, String extractionPath) {
    // Perform initial extraction
    // ...

    // Validate extracted file paths
    Path extractedPath = Paths.get(extractionPath);
    if (!extractedPath.normalize().startsWith(Paths.get(extractionPath).normalize())) {
      throw new SecurityException("Invalid file path detected. Extraction aborted.");
    }

    // Continue with further processing
    // ...
  }
}

Conclusion

The vulnerability in WildFly Core allows for the extraction of crafted .war archives to overwrite arbitrary files, leading to unauthorized access, data loss, or the execution of arbitrary code. It is crucial to update the WildFly Core package to version 6.0.0.Alpha3 or later to mitigate this vulnerability. Implementing a file path validation mechanism during archive extraction can serve as a temporary workaround. For further assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.wildfly.core:wildfly-server →

FAQ