CVE-2020-8908: Information Disclosure in Guava

Background

Guava is an open-source Java library developed by Google that provides utility classes for common programming tasks. It offers a wide range of functionalities, including collections, caching, concurrency, and input/output operations. One of the features provided by Guava is the ability to create temporary directories using the com.google.common.io.Files.createTempDir() method. However, a vulnerability exists in all versions of Guava that can potentially lead to information disclosure. When a temporary directory is created using this method, it inherits the default permissions of the underlying operating system, which are typically the standard Unix-like /tmp permissions. This leaves the files in the temporary directory open and accessible to an attacker with access to the machine.

Vulnerability Detail

The vulnerability allows an attacker with access to the machine to potentially access data in a temporary directory created by Guava's createTempDir() method. By default, the permissions granted to the directory are not secure, making it possible for an attacker to read sensitive information stored in the temporary files. This can lead to the exposure of confidential data, such as user credentials or other sensitive information. The vulnerability has been assigned the CVE identifier CVE-2020-8908 and has a CVSS score of 3.3, indicating a low severity level.

Workaround

As a workaround, developers can manually change the permissions of the temporary directory after it is created using the java.nio.file.Files.setPosixFilePermissions() method. By setting the appropriate permissions, the files within the directory can be protected from unauthorized access. Here is an example code snippet that demonstrates how to change the permissions of a temporary directory created by Guava:

import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.attribute.PosixFilePermission;
import java.util.HashSet;
import java.util.Set;

public class TempDirectoryExample {
    public static void main(String[] args) throws Exception {
        Path tempDir = Files.createTempDirectory(null);
        Set<PosixFilePermission> permissions = new HashSet<>();
        permissions.add(PosixFilePermission.OWNER_READ);
        permissions.add(PosixFilePermission.OWNER_WRITE);
        permissions.add(PosixFilePermission.OWNER_EXECUTE);
        Files.setPosixFilePermissions(tempDir, permissions);
    }
}

Conclusion

In conclusion, the Guava library is vulnerable to an information disclosure issue when creating temporary directories. This vulnerability can potentially lead to the exposure of sensitive data stored in temporary files. To mitigate the risk, it is recommended to change the permissions of the temporary directory after its creation or avoid using the vulnerable method. Developers should also consider using more secure alternatives provided by the operating system or other libraries. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for com.google.guava:guava →

FAQ