Path Traversal Vulnerability in github.com/cloudflare/cfrpki/cmd/octorpki
Summary
CVE-2021-3907: Path traversal in github.com/cloudflare/cfrpki/cmd/octorpki. Affects github.com/cloudflare/cfrpki versions < 1.4.3. Fixed in 1.4.3. How to fix ↓
Also tracked for
- cfrpki · Debian:11
The same CVE-2021-3907 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/cloudflare/cfrpki/cmd/octorpki is written in Go and is used for managing and validating Resource Public Key Infrastructure (RPKI) data. It provides functionality for parsing TAL (Trust Anchor Locator) files and downloading ROA (Route Origin Authorization) files. These files are used to verify the authenticity and validity of routing information on the internet. The package is widely used in network infrastructure and security applications.
Vulnerability Detail
The package is vulnerable to a path traversal attack. If a malicious TAL file is parsed, pointing to a repository that provides a malicious ROA file, octorpki can download and process the malicious file. This can lead to a bypass of the current directory traversal mitigation and allow writing outside of the current directory. An attacker could exploit this vulnerability to overwrite or modify sensitive files on the system, potentially leading to unauthorized access, data leakage, or system compromise.
How To Fix
Minimum fixed version
1.4.3
This is the first release that contains the fix.
go get github.com/cloudflare/cfrpki@v1.4.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no workaround is available for this vulnerability. It is recommended to follow the best practices mentioned in the 'how_to_fix' section and wait for a patched version of the package to be released.
Conclusion
The package github.com/cloudflare/cfrpki/cmd/octorpki is vulnerable to a path traversal attack, which can lead to unauthorized access, data leakage, or system compromise. It is important to update to a patched version of the package once it becomes available. Exercise caution when handling TAL files from untrusted sources and ensure the security of repositories providing ROA files. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/cloudflare/cfrpki →
FAQ
The vulnerability allows an attacker to bypass directory traversal mitigation and write outside of the current directory. This can lead to unauthorized access, data leakage, or system compromise.
Versions 0 to 1.4.2 of the package are affected by this vulnerability.
Currently, there are no known exploits for this vulnerability. However, it is important to patch the package as soon as a fix becomes available to prevent any potential exploitation.
Unfortunately, there is no known workaround for this vulnerability. It is recommended to exercise caution when parsing TAL files from untrusted sources and to ensure the trustworthiness and security of the repositories providing ROA files.
You can monitor the GitHub repository of the package for any updates on the patch release. It is also recommended to subscribe to security mailing lists or follow trusted security sources for any announcements regarding this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cloudflare/cfrpki.
