CVE-2021-23772: Link Following in Iris

Background

The package under scrutiny is github.com/kataras/iris, a Go package that provides a fast, simple, and efficient framework for building web applications. It is widely used in the Go ecosystem and offers various features such as routing, middleware, and template rendering. However, all versions of the package are vulnerable to a link following vulnerability. This vulnerability arises from the unsafe handling of file names during file uploads using the UploadFormFiles method. Attackers can exploit this vulnerability to write files to arbitrary locations outside the designated target folder.

Vulnerability Detail

The link following vulnerability in Iris allows attackers to manipulate file names during file uploads, potentially leading to the writing of files in unintended locations. By crafting malicious file names, attackers can bypass the intended target folder and write files to arbitrary locations on the system. This can result in unauthorized access, data leakage, and potential remote code execution. The vulnerability has a CVSS score of 7.5, indicating a high severity level.

go get github.com/kataras/iris/v12@v12.2.0-alpha8

Workaround

As a temporary workaround, developers can implement additional validation and sanitization checks on file names during file uploads. This can include restricting the allowed characters, length, and file extensions. By enforcing strict validation, the risk of link following attacks can be mitigated. Here is an example of how to implement file name validation in Go:

func validateFileName(fileName string) bool {
    // Implement your validation logic here
    // Return true if the file name is valid, false otherwise
}

func uploadFileHandler(ctx iris.Context) {
    file, err := ctx.FormFile("file")
    if err != nil {
        // Handle error
        return
    }

    fileName := file.Filename
    if !validateFileName(fileName) {
        // Handle invalid file name
        return
    }

    // Proceed with file upload
}

Conclusion

The link following vulnerability in Iris can have severe consequences, including unauthorized access, data leakage, and potential remote code execution. It is crucial to update to the latest fixed versions of the package to address this vulnerability. Additionally, implementing strict file name validation and sanitization checks can provide temporary mitigation. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for github.com/kataras/iris/v12 →

FAQ