CVE-2021-32643: Open Source Vulnerability in org.http4s:http4s-core
Summary
CVE-2021-32643: StaticFile.fromUrl can leak presence of a directory. Affects org.http4s:http4s-core across 4 version ranges.
>= 0.21.7, < 0.21.24
>= 0.22.0-M1, < 0.22.0-RC1
>= 0.23.0-M1, < 0.23.0-RC1
>= 1.0.0-M1, < 1.0.0-M23
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.http4s:http4s-core is a popular open-source library used for building HTTP applications in Scala. It provides a set of tools and utilities for handling HTTP requests and responses. This vulnerability affects versions 0.21.7 through 0.21.23, 0.22.0-M1 through 0.22.0-M8, 0.23.0-M1, and 1.0.0-M1 through 1.0.0-M22. The vulnerability allows an attacker to infer the presence of a directory on a server by exploiting the StaticFile.fromUrl function. By providing a fetchable resource URL that points to a directory, an attacker can determine the existence of the directory on the server through the 404 response.
Vulnerability Detail
The StaticFile.fromUrl function in org.http4s:http4s-core does not properly check the scheme and authority of the provided URL. This allows an attacker to leak the presence of a directory on a server by exploiting the behavior of the function. If the URL scheme is not file:// and the URL points to a fetchable resource under its scheme and authority, the function returns F[None] without checking if the URL path is a directory. This can be abused by an attacker to infer the existence of a directory on the server through the 404 response. The contents and other metadata of the directory are not exposed.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.21.7, < 0.21.240.21.24 -
>= 0.22.0-M1, < 0.22.0-RC10.22.0-RC1 -
>= 0.23.0-M1, < 0.23.0-RC10.23.0-RC1 -
>= 1.0.0-M1, < 1.0.0-M231.0.0-M23
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A workaround for this vulnerability is to avoid calling the StaticFile.fromUrl function with non-file URLs. By ensuring that only file URLs are passed to the function, the vulnerability can be mitigated.
Conclusion
The vulnerability in org.http4s:http4s-core allows an attacker to infer the presence of a directory on a server. To mitigate this vulnerability, it is recommended to update to the patched versions of the library or avoid using the StaticFile.fromUrl function with non-file URLs. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.http4s:http4s-core →
FAQ
org.http4s:http4s-core is an open-source library for building HTTP applications in Scala. It provides tools and utilities for handling HTTP requests and responses.
This vulnerability affects versions 0.21.7 through 0.21.23, 0.22.0-M1 through 0.22.0-M8, 0.23.0-M1, and 1.0.0-M1 through 1.0.0-M22 of org.http4s:http4s-core.
The vulnerability allows an attacker to infer the presence of a directory on a server by exploiting the behavior of the StaticFile.fromUrl function. The contents and other metadata of the directory are not exposed.
To fix this vulnerability, it is recommended to update to the patched versions of org.http4s:http4s-core: v0.21.24, v0.22.0-RC1, v0.23.0-RC1, or v1.0.0-M23.
Yes, a workaround for this vulnerability is to avoid calling the StaticFile.fromUrl function with non-file URLs.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.http4s:http4s-core.
