CVE-2019-0207: Path traversal attack on Windows platforms in org.apache.tapestry:tapestry-core

Background

org.apache.tapestry:tapestry-core is a Maven package that provides core functionality for the Tapestry web application framework. It includes classes and utilities for handling assets, such as the StaticFilesFilter, AssetDispatcher, and ContextResource. These components are responsible for processing and serving static assets in a Tapestry application.

Vulnerability Detail

The vulnerability (CVE-2019-0207) arises from a path traversal attack that can be performed on Windows platforms. The issue lies in the way Tapestry processes assets using the classes chain StaticFilesFilter -> AssetDispatcher -> ContextResource. These classes do not properly filter the character '', allowing an attacker to traverse the file system and read any files on a Windows platform. This can lead to unauthorized access to sensitive information and potential compromise of the system.

Workaround

If upgrading the package is not immediately feasible, a temporary workaround is to implement a custom filter or interceptor that sanitizes the asset paths and prevents path traversal attacks. Here is an example of a filter that can be used:

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;

public class AssetPathFilter implements Filter {

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        // Initialization code
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        String assetPath = httpRequest.getParameter("assetPath");
        if (assetPath != null && assetPath.contains("\\")) {
            // Handle the path traversal attack
            // Log or block the request
        }
        chain.doFilter(request, response);
    }

    @Override
    public void destroy() {
        // Cleanup code
    }
}

This filter intercepts requests and checks if the "assetPath" parameter contains the '' character. If it does, appropriate actions can be taken, such as logging the request or blocking it.

Conclusion

In conclusion, the org.apache.tapestry:tapestry-core package is vulnerable to a path traversal attack on Windows platforms. This can lead to unauthorized access to sensitive files and potential compromise of the system. It is recommended to upgrade to version 5.4.5 or later to fix this vulnerability. If immediate upgrade is not possible, implementing a custom filter or interceptor can provide a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.apache.tapestry:tapestry-core →

FAQ