CVE-2018-12542: Eclipse Vert.x StaticHandler Path Traversal Vulnerability
Summary
CVE-2018-12542: In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\' (forward slashes) sequ... Affects io.vertx:vertx-web versions >= 3.0.0, < 3.5.4. Fixed in 3.5.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse Vert.x is an open-source, event-driven application framework that allows developers to build reactive applications on the Java Virtual Machine (JVM). It provides a set of libraries for building scalable and high-performance applications. The StaticHandler component in Eclipse Vert.x is responsible for serving static files from the file system. However, versions 3.0.0 to 3.5.3 of Eclipse Vert.x are vulnerable to a path traversal attack on Windows Operating Systems.
Vulnerability Detail
The vulnerability arises from the improper neutralization of '' (forward slashes) sequences in the pathname constructed by the StaticHandler. This allows an attacker to provide external input that can resolve to a location outside of the restricted directory. By exploiting this vulnerability, an attacker can access sensitive files or execute arbitrary code on the affected system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
3.5.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually validating and sanitizing user input. This can be done by checking for any '' sequences in the input and rejecting or modifying them to prevent path traversal. Here is an example in Java:
String userInput = ...; // User-provided input
if (userInput.contains("\\")) {
// Handle or reject the input
}
Conclusion
The Eclipse Vert.x StaticHandler Path Traversal vulnerability allows attackers to access sensitive files or execute arbitrary code on affected systems. It is crucial to upgrade to the latest version of Eclipse Vert.x (3.5.4 or later) to mitigate this vulnerability. If immediate upgrading is not possible, developers should implement the provided workaround and ensure proper input validation and sanitization. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.vertx:vertx-web →
FAQ
Eclipse Vert.x is an open-source, event-driven application framework for building reactive applications on the JVM. It provides a set of libraries for developing scalable and high-performance applications.
The StaticHandler component in Eclipse Vert.x is responsible for serving static files from the file system. It allows developers to serve HTML, CSS, JavaScript, and other static resources in their applications.
Path traversal is a vulnerability that allows an attacker to access files or directories outside of the intended directory. It occurs when user input is not properly validated or sanitized, allowing malicious input to navigate to sensitive areas of the file system.
By exploiting this vulnerability, an attacker can access sensitive files or execute arbitrary code on the affected system. This can lead to unauthorized access, data leakage, or even complete compromise of the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert is a platform that monitors and alerts in real-time for open-source vulnerabilities in software, using just the pom.xml file.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.vertx:vertx-web.
