CVE-2018-13864: Directory Traversal Vulnerability in Play Framework's Assets Controller

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

Play Framework is a popular web application framework written in Scala and Java. It provides a set of tools and libraries for building scalable and efficient web applications. The Assets controller in Play Framework allows developers to serve static assets such as CSS, JavaScript, and images. However, versions 2.6.12 through 2.6.15 of Play Framework are vulnerable to a directory traversal attack when running on Windows. This vulnerability can be exploited by a remote attacker to download arbitrary files from the target server by sending specially crafted HTTP requests.

Vulnerability Detail

The directory traversal vulnerability in Play Framework's Assets controller allows an attacker to bypass the intended restrictions and access files outside of the designated asset directory. By manipulating the HTTP requests, an attacker can traverse directories and download sensitive files from the server. This can lead to unauthorized access to confidential information, such as configuration files, database credentials, or source code. The vulnerability has a CVSS score of 7.5, indicating a high severity level.

Workaround

If upgrading to the latest version is not immediately feasible, a temporary workaround is to implement additional server-side validation to prevent directory traversal attacks. This can be done by checking the requested file paths against a whitelist of allowed directories or by using a secure file serving library that handles file access securely. Here is an example of server-side validation using a whitelist in Java:

public Result serveFile(String filePath) {
  List<String> allowedDirectories = Arrays.asList("/assets/");
  if (allowedDirectories.stream().anyMatch(filePath::startsWith)) {
    // Serve the file
  } else {
    // Return an error response
  }
}

Conclusion

The directory traversal vulnerability in Play Framework's Assets controller can lead to unauthorized access to sensitive files on the server. It is crucial to upgrade to the latest version of Play Framework (2.6.16 or later) to fix this vulnerability. In the meantime, implementing server-side validation can provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for com.typesafe.play:play_2.12 →

FAQ