CVE-2018-17785: Directory Traversal Vulnerability in com.github.blynkkk:blynk-server
Summary
CVE-2018-17785: In blynk-server a Directory Traversal exists. Affects com.github.blynkkk:blynk-server versions < 0.39.7. Fixed in 0.39.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
com.github.blynkkk:blynk-server is an open-source server for the Blynk platform, which enables users to build IoT applications. It provides a range of features and functionalities to facilitate the development and management of IoT projects. However, the package is vulnerable to a Directory Traversal attack.
Vulnerability Detail
The vulnerability, identified as CVE-2018-17785, allows an attacker to perform Directory Traversal by exploiting a specific URI pattern. By including '../' in a URI that starts with '/static' or '/static/js', an attacker can read arbitrary files on the server. This can lead to unauthorized access to sensitive information, such as the /etc/passwd file. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
0.39.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to implement input validation and sanitization for the affected URIs. By properly validating and sanitizing user input, it is possible to prevent the exploitation of the Directory Traversal vulnerability. Here is an example of how input validation can be implemented in Java:
String uri = getRequestURI();
if (uri.startsWith("/static") || uri.startsWith("/static/js")) {
// Perform input validation and sanitization
}
Please note that this is a temporary solution and upgrading to the latest version is still recommended.
Conclusion
In conclusion, the com.github.blynkkk:blynk-server package is vulnerable to a Directory Traversal attack. It is crucial to upgrade to version 0.39.7 or later to address this vulnerability. If immediate upgrading is not possible, implementing input validation and sanitization for the affected URIs can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.github.blynkkk:blynk-server →
FAQ
com.github.blynkkk:blynk-server is an open-source server for the Blynk platform, which enables users to build IoT applications. It provides a range of features and functionalities to facilitate the development and management of IoT projects.
A Directory Traversal vulnerability allows an attacker to access files and directories outside of the intended scope. By manipulating file paths or URIs, an attacker can bypass access restrictions and read sensitive information or execute arbitrary code.
The vulnerability allows an attacker to read arbitrary files on the server, potentially leading to unauthorized access to sensitive information. This can include credentials, configuration files, or other confidential data.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to version 0.39.7 or later of com.github.blynkkk:blynk-server. This version includes a patch that mitigates the Directory Traversal issue.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
