CVE-2022-23082: Path Traversal in CureKit
Summary
CVE-2022-23082: Path traversal in CureKit. Affects io.whitesource:curekit versions >= 1.0.1, < 1.1.4. Fixed in 1.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CureKit is an open-source package in the Maven ecosystem developed by io.whitesource. It provides functionality for handling and processing files. CureKit versions v1.0.1 through v1.1.3 are susceptible to a path traversal vulnerability. This vulnerability arises due to the lack of input sanitization in the isFileOutsideDir function, allowing an attacker to perform path traversal attacks.
Vulnerability Detail
The path traversal vulnerability in CureKit can be exploited by an attacker to access files outside the intended directory. By manipulating the input, an attacker can traverse the file system and potentially access sensitive files or execute arbitrary code. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.1.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is advised to upgrade to the fixed version as soon as possible.
Conclusion
CureKit versions v1.0.1 through v1.1.3 are vulnerable to a path traversal issue, which can be exploited to access files outside the intended directory. Upgrading to version 1.1.4 or later is recommended to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.whitesource:curekit →
FAQ
The vulnerability allows an attacker to access files outside the intended directory, potentially leading to unauthorized access or execution of arbitrary code.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file to analyze and receive real-time alerts for open-source vulnerabilities.
At the time of this report, there is no known exploit publicly available for this vulnerability. However, it is crucial to address the issue promptly to mitigate any potential risks.
No, only CureKit versions v1.0.1 through v1.1.3 are vulnerable to this path traversal issue. Upgrading to version 1.1.4 or later will resolve the vulnerability.
There is no evidence of active exploitation of this vulnerability at the time of this report. However, it is recommended to apply the fix as soon as possible to prevent any potential attacks.
