CVE-2022-25842: Path Traversal in com.alibaba.oneagent:one-java-agent-plugin
Summary
CVE-2022-25842: Path Traversal in com.alibaba.oneagent:one-java-agent-plugin. Affects com.alibaba.oneagent:one-java-agent-plugin versions < 0.0.2. Fixed in 0.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.alibaba.oneagent:one-java-agent-plugin is a Maven package that provides a Java agent plugin for Alibaba's OneAgent. This plugin is used to monitor and trace Java applications. It integrates with the OneAgent framework to collect performance metrics and diagnostic information. However, all versions of this package are vulnerable to a Path Traversal vulnerability known as Zip Slip. This vulnerability allows an attacker to write arbitrary files to the file system by exploiting directory traversal in filenames within specially crafted archives. By overwriting executable files, the attacker can achieve remote command execution on the victim's machine.
Vulnerability Detail
The vulnerability in com.alibaba.oneagent:one-java-agent-plugin arises from a lack of proper input validation during archive extraction. An attacker can create a malicious archive with filenames containing directory traversal sequences (e.g., ../../evil.exe). When the plugin extracts the archive, it fails to properly sanitize the filenames, allowing the attacker to write files outside of the intended directory. This can lead to the overwrite of critical executable files, which can be later invoked remotely or triggered by the system or user, resulting in remote command execution. The impact of this vulnerability can be severe, as it grants an attacker unauthorized access and control over the victim's machine.
How To Fix
Minimum fixed version
0.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the package to the fixed version as soon as possible.
Conclusion
The com.alibaba.oneagent:one-java-agent-plugin package is vulnerable to a Path Traversal vulnerability known as Zip Slip. This vulnerability allows an attacker to write arbitrary files to the file system, potentially leading to remote command execution. To mitigate this risk, it is recommended to update the package to version 0.0.2 or later. Regularly updating all dependencies is also important to ensure the latest security patches are applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.alibaba.oneagent:one-java-agent-plugin →
FAQ
com.alibaba.oneagent:one-java-agent-plugin is a Maven package that provides a Java agent plugin for Alibaba's OneAgent. It is used to monitor and trace Java applications, collecting performance metrics and diagnostic information.
Zip Slip is a path traversal vulnerability that occurs during archive extraction. It allows an attacker to write files outside of the intended directory by using specially crafted filenames containing directory traversal sequences.
The impact of this vulnerability can be severe. An attacker can overwrite critical executable files, which can later be invoked remotely or triggered by the system or user, resulting in remote command execution on the victim's machine.
To fix this vulnerability, update the com.alibaba.oneagent:one-java-agent-plugin package to version 0.0.2 or later. Make sure to regularly update all dependencies to apply the latest security patches.
There is no known workaround for this vulnerability. It is crucial to update the package to the fixed version as soon as possible.
