Directory Traversal Vulnerability in JCraft JSch
Summary
CVE-2016-5725: Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a r... Affects jsch versions < 0.1.54-1. Fixed in 0.1.54-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JCraft JSch is a Java implementation of the SSH2 protocol, providing a secure channel for data communication. It is commonly used for secure file transfer (SFTP) and remote command execution. However, versions prior to 0.1.54 on Windows are vulnerable to a directory traversal attack. This vulnerability allows remote SFTP servers to write to arbitrary files by exploiting a response to a recursive GET command that contains a '..' (dot dot backslash) sequence.
Vulnerability Detail
The directory traversal vulnerability in JCraft JSch on Windows occurs when the mode is set to ChannelSftp.OVERWRITE. By manipulating the response to a recursive GET command, an attacker can traverse directories and write to files outside of the intended directory. This can lead to unauthorized modification or disclosure of sensitive information. The vulnerability has a CVSSv3 score of 5.9, indicating a moderate severity.
How To Fix
Minimum fixed version
0.1.54-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jschTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to avoid using the ChannelSftp.OVERWRITE mode. Instead, use other modes such as ChannelSftp.RESUME or ChannelSftp.APPEND, which are not affected by the vulnerability. Review the code that interacts with JCraft JSch and modify it accordingly.
Conclusion
The directory traversal vulnerability in JCraft JSch can be mitigated by updating the package to version 0.1.54-1 or later. If immediate update is not possible, using alternative modes that are not affected by the vulnerability can serve as a temporary workaround. For further assistance and support in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for jsch →
FAQ
JCraft JSch is a Java implementation of the SSH2 protocol, providing secure communication channels for data transfer and remote command execution.
A directory traversal vulnerability allows an attacker to access files and directories outside of the intended scope by manipulating input or responses that involve file paths.
An attacker can exploit this vulnerability by sending a specially crafted response to a recursive GET command, containing a '..' sequence to traverse directories and write to arbitrary files.
The directory traversal vulnerability in JCraft JSch can lead to unauthorized modification or disclosure of sensitive files. An attacker could overwrite critical files or access confidential information.
The CVSSv3 score of this vulnerability is 5.9, indicating a moderate severity.
Related vulnerabilities
Recent vulnerabilities recorded for jsch.
