CVE-2021-23331: Insecure temporary file used in com.squareup:connect
Summary
CVE-2021-23331: Insecure temporary file used in com.squareup:connect. Affects com.squareup:connect versions < 2.20191120.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.squareup:connect package is an open-source library used for connecting to various services. It provides functionality for downloading files from a remote server. However, all versions of this package are vulnerable to an insecure temporary file issue. The method prepareDownloadFile creates a temporary file with incorrect permissions on Unix-like systems, making the downloaded file visible to all users on the local system. This can lead to unauthorized access and exposure of sensitive information.
Vulnerability Detail
The vulnerability in com.squareup:connect arises from the creation of temporary files with incorrect permissions. When the method prepareDownloadFile is called, it creates a temporary file with the permissions bits of -rw-r--r-- on Unix-like systems. As a result, the downloaded file can be accessed by other users on the system. This can lead to the exposure of sensitive data to unauthorized parties. The issue has been assigned a CVSS score of 3.3, indicating a low severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can set the system property java.io.tmpdir to a safe directory. By doing so, you can ensure that temporary files created by the com.squareup:connect package are stored in a secure location with appropriate permissions. This will mitigate the risk of unauthorized access to downloaded files. Here's an example of how to set the java.io.tmpdir system property:
System.setProperty("java.io.tmpdir", "/path/to/safe/directory");
Conclusion
The com.squareup:connect package is vulnerable to an insecure temporary file issue, which can lead to unauthorized access to downloaded files. To mitigate this vulnerability, it is recommended to upgrade to the latest version of the package. Additionally, setting the java.io.tmpdir system property to a safe directory can provide a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.squareup:connect →
FAQ
The vulnerability allows other users on the local system to access the contents of downloaded files, potentially exposing sensitive information.
All versions of com.squareup:connect are affected up to version 2.20191120.0.
Yes, upgrading to the latest version of com.squareup:connect will fix the vulnerability.
Yes, setting the java.io.tmpdir system property to a safe directory can mitigate the risk of unauthorized access to downloaded files.
You can find more information about this vulnerability in the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-q4hm-fwc9-hmv6/GHSA-q4hm-fwc9-hmv6.json
