CVE-2021-28100: Netflix/Priam: Temporary Directory Information Disclosure
Summary
CVE-2021-28100: Netflix/Priam: Temporary Directory Information Disclosure. Affects com.netflix.priam:priam versions < 3.1.104. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The impacted package is com.netflix.priam:priam, which is a Maven package. Priam is a backup and restore system developed by Netflix. It provides functionalities for managing metadata, identity, and post-restore hooks. The vulnerability in this package allows for temporary directory information disclosure, potentially exposing sensitive information to unauthorized users.
Vulnerability Detail
The vulnerability arises from the use of File.createTempFile in the code. This method creates temporary files with permissions set to -rw-r--r--, allowing other users to read the contents of these files. Although they cannot modify the contents, this still poses a risk of local information disclosure if the files contain sensitive information. The vulnerable locations in the code are:
- MetaData.java: lines 106-111
- DoubleRing.java: lines 109-118
- PostRestoreHook.java: lines 80-86
The impact of this vulnerability is moderate, with a CVSS score of 6.2. It can potentially lead to the exposure of sensitive data to unauthorized users.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
A possible workaround for this vulnerability is to manually set the permissions of the temporary files after they are created. This can be done using the setReadable and setWritable methods of the File class. Here is an example of how to implement this workaround:
File tempFile = File.createTempFile(prefix, suffix);
tempFile.setReadable(false);
tempFile.setWritable(false);
Conclusion
The com.netflix.priam:priam package is vulnerable to a temporary directory information disclosure issue, which can potentially expose sensitive data to unauthorized users. It is advised to apply the suggested fix or implement the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.netflix.priam:priam →
FAQ
The impact of this vulnerability is moderate, with a CVSS score of 6.2. It can potentially lead to the exposure of sensitive data to unauthorized users.
Versions 0 to 3.1.104 of the com.netflix.priam:priam package are affected by this vulnerability.
There are no fixed versions available for this vulnerability at the moment.
To mitigate the risk of this vulnerability, it is recommended to apply the suggested fix by modifying the code at the vulnerable locations.
Yes, a possible workaround is to manually set the permissions of the temporary files after they are created using the setReadable and setWritable methods of the File class.
