CVE-2022-46178: Path Traversal In MeterSphere leads to upload file to any path
Summary
CVE-2022-46178: Path Traversal In MeterSpere leads to upload file to any path. Affects io.metersphere:metersphere versions < 2.5.1. Fixed in 2.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MeterSphere is an open-source platform that allows users to manage and monitor the performance of their software applications. It provides various features such as test management, performance testing, and API testing. The vulnerability in MeterSphere allows users to upload files without proper validation of the file name, potentially leading to path traversal attacks. This means that an attacker could upload a file to any location on the server, compromising the integrity and security of the system.
Vulnerability Detail
The vulnerability arises from the lack of file path validation in the FileUtils.java file of MeterSphere. The createFile method in this file does not check the filePath parameter, allowing an attacker to specify a malicious file path and upload a file to an arbitrary location on the server. This can lead to unauthorized access, data leakage, and potential remote code execution. The vulnerability has a CVSS score of 7.4, indicating a high severity level.
How To Fix
Minimum fixed version
2.5.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a temporary workaround can be implemented by manually validating the file path before calling the createFile method. This can be done by checking if the file path is within the expected directory structure and rejecting any paths that are outside of it. Here is an example of how this validation can be implemented in Java:
public static void createFile(String filePath, byte[] fileBytes) {
// Perform manual validation of filePath
if (!filePath.startsWith("/expected/directory/")) {
throw new SecurityException("Invalid file path");
}
// Rest of the createFile method implementation
// ...
}
Conclusion
The path traversal vulnerability in MeterSphere allows for unauthorized file uploads to arbitrary locations on the server. It is crucial to upgrade to version 2.5.1 or later to mitigate this vulnerability. If immediate upgrading is not possible, implementing a manual file path validation workaround can provide temporary protection. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for io.metersphere:metersphere →
FAQ
MeterSphere is an open-source platform for managing and monitoring software application performance.
The vulnerability allows an attacker to upload files to arbitrary locations on the server, potentially leading to unauthorized access, data leakage, and remote code execution.
The vulnerability can be fixed by upgrading to version 2.5.1 or later of MeterSphere, which includes the necessary file path validation.
A temporary workaround is to manually validate the file path before calling the createFile method, ensuring that it is within the expected directory structure.
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
