CVE-2021-3907: Directory Traversal in manifest path extraction in github.com/cloudflare/cfrpki

Background

The package under scrutiny is github.com/cloudflare/cfrpki, which is written in Go. It is a library that provides functionality for managing and validating PKI (Public Key Infrastructure) resources. The package includes the ExtractPathManifest function, which is responsible for extracting the path of a manifest file. However, this function is vulnerable to directory traversal attacks, allowing an attacker to reference arbitrary locations on the filesystem by including relative directory components ("..") in the file path.

Vulnerability Detail

The vulnerability in github.com/cloudflare/cfrpki's ExtractPathManifest function allows an attacker to traverse directories and access files outside the intended scope. By including relative directory components in the file path, an attacker can bypass file path restrictions and potentially access sensitive files on the filesystem. This could lead to unauthorized access, information disclosure, or even remote code execution depending on the specific circumstances. The vulnerability has been assigned the CVE identifier CVE-2021-3907.

go get github.com/cloudflare/cfrpki@v1.5.10

go get github.com/cloudflare/cfrpki@v1.4.3

Workaround

If updating the package is not immediately feasible, a temporary workaround can be implemented by manually validating and sanitizing file paths before passing them to the ExtractPathManifest function. This can be done by checking for any relative directory components ("..") in the file path and rejecting or modifying the path accordingly. Here is an example of how this can be done in Go:

import (
	"github.com/cloudflare/cfrpki/validator/pki"
	"path/filepath"
)

func SanitizeFilePath(filePath string) (string, error) {
	absPath, err := filepath.Abs(filePath)
	if err != nil {
		return "", err
	}

	if filepath.Clean(absPath) != absPath {
		return "", fmt.Errorf("Invalid file path")
	}

	return absPath, nil
}

Conclusion

In conclusion, the github.com/cloudflare/cfrpki package is vulnerable to a directory traversal attack in its ExtractPathManifest function. This vulnerability allows an attacker to access arbitrary files on the filesystem. To fix this vulnerability, it is recommended to update the package to version 1.4.3 or later. If immediate update is not possible, a temporary workaround can be implemented by manually validating and sanitizing file paths. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for github.com/cloudflare/cfrpki →

FAQ