Directory Traversal Vulnerability in GeSHi Package: CVE-2012-3521
Summary
CVE-2012-3521: Multiple directory traversal vulnerabilities in the cssgen contrib module in GeSHi before 1.0.8.11 allow remote attackers to read arbitrary files via a .. Affects geshi versions < 1.0.8.4-2. Fixed in 1.0.8.4-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GeSHi (Generic Syntax Highlighter) is a popular open-source library used for syntax highlighting in various programming languages. It is widely utilized in web applications to enhance code readability by applying color coding to different syntax elements. However, certain versions of the cssgen contrib module in GeSHi are vulnerable to directory traversal attacks, which can lead to unauthorized access to sensitive files on the server.
Vulnerability Detail
The vulnerability identified as CVE-2012-3521 arises from multiple directory traversal flaws in the cssgen contrib module of GeSHi prior to version 1.0.8.11. Attackers can exploit this vulnerability by manipulating the geshi-path or geshi-lang-path parameters to include '..' (dot dot) sequences, allowing them to traverse the directory structure and access arbitrary files on the server. This can lead to exposure of sensitive information, including configuration files and user data, potentially compromising the security of the application.
How To Fix
Minimum fixed version
1.0.8.4-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade geshiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, a temporary workaround is to validate and sanitize the input for the geshi-path and geshi-lang-path parameters to prevent the inclusion of '..' sequences. This can be done by implementing checks in the application code to ensure that these parameters do not contain any directory traversal patterns.
Conclusion
CVE-2012-3521 represents a significant security risk for applications using vulnerable versions of the GeSHi package. It is crucial to upgrade to a fixed version to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround until an upgrade can be performed.
See every vulnerability recorded for geshi →
FAQ
CVE-2012-3521 is a vulnerability in the GeSHi package that allows remote attackers to exploit directory traversal flaws to read arbitrary files on the server.
Versions of GeSHi prior to 1.0.8.11 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to sensitive files, which may compromise the security of the application and expose confidential information.
Yes, you can implement input validation and sanitization for the geshi-path and geshi-lang-path parameters to prevent directory traversal attacks as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for geshi.
