CVE-2021-44138: Path Traversal in Caucho Resin
Summary
CVE-2021-44138: Path Traversal in Caucho Resin. Affects com.caucho:resin versions >= 4.0.52, <= 4.0.56. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Caucho Resin is an open-source Java application server that provides a fast and reliable platform for hosting Java applications. It is widely used in enterprise environments for its scalability and performance. However, versions 4.0.52 to 4.0.56 of Caucho Resin are vulnerable to a directory traversal attack. This vulnerability allows remote attackers to read files in arbitrary directories by exploiting a path traversal issue in the handling of HTTP requests.
Vulnerability Detail
The path traversal vulnerability in Caucho Resin arises from a failure to properly sanitize user-supplied input. By including a semicolon (;) in the pathname of an HTTP request, an attacker can bypass directory restrictions and access files outside the intended directory. This can lead to unauthorized disclosure of sensitive information, such as configuration files or user data. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement input validation and filtering mechanisms to prevent the inclusion of semicolons (;) in the pathnames of HTTP requests. By rejecting or sanitizing such input, the risk of path traversal attacks can be mitigated. Here is an example of how to perform input validation in Java:
String sanitizedPath = request.getPath().replace(";", "");
Conclusion
In conclusion, Caucho Resin versions 4.0.52 to 4.0.56 are vulnerable to a path traversal attack that allows remote attackers to read files in arbitrary directories. To mitigate this vulnerability, it is crucial to upgrade to a non-vulnerable version of Caucho Resin and regularly apply security updates. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.caucho:resin →
FAQ
The vulnerability allows remote attackers to read files in arbitrary directories, potentially leading to unauthorized access to sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a patch is available for this vulnerability. Users should update their Caucho Resin installation to a version beyond 4.0.56 to mitigate the risk.
At the time of this report, there are no known exploits for this vulnerability. However, it is important to apply the patch or upgrade to a non-vulnerable version to prevent potential exploitation.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.caucho:resin.
