CVE-2018-7490: uWSGI Directory Traversal Vulnerability
Summary
CVE-2018-7490: uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal. Affects uwsgi versions < 2.0.17. Fixed in 2.0.17. How to fix ↓
Also tracked for
- uwsgi · Alpine:v3.4
The same CVE-2018-7490 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
uWSGI is a fast, self-healing and developer-friendly application server that deploys web applications written in various languages, including Python. It provides a wide range of features such as load balancing, caching, and process management. This vulnerability affects uWSGI versions prior to 2.0.17 and is related to the mishandling of the DOCUMENT_ROOT check when using the --php-docroot option. This flaw allows an attacker to perform directory traversal attacks, potentially accessing sensitive files outside the intended directory.
Vulnerability Detail
The vulnerability in uWSGI arises from a lack of proper input validation when processing the --php-docroot option. By manipulating the value of this option, an attacker can bypass the intended document root directory and traverse the file system to access files or directories that should be restricted. This could lead to unauthorized disclosure of sensitive information or even remote code execution if the attacker can exploit other vulnerabilities in the system. It is important to note that this vulnerability only affects uWSGI versions prior to 2.0.17.
How To Fix
Minimum fixed version
2.0.17
This is the first release that contains the fix.
pip install --upgrade "uwsgi==2.0.17"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading uWSGI is not immediately feasible, a temporary workaround can be implemented by disabling the --php-docroot option or ensuring that the value provided for this option is properly validated and restricted to the intended document root directory. Here is an example of how to disable the --php-docroot option in a uWSGI configuration file:
[uwsgi]
php-docroot=
By setting the value of php-docroot to an empty string, the vulnerable functionality is effectively disabled.
Conclusion
The uWSGI directory traversal vulnerability (CVE-2018-7490) allows attackers to bypass the intended document root directory and access sensitive files outside the intended scope. To mitigate this vulnerability, it is recommended to upgrade uWSGI to version 2.0.17 or later. If immediate upgrade is not possible, disabling the --php-docroot option or properly validating its value can serve as a temporary workaround. Stay vigilant and apply the necessary security patches to protect your system from potential exploitation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for uwsgi →
FAQ
The vulnerability allows an attacker to perform directory traversal attacks, potentially accessing sensitive files outside the intended directory. This could lead to unauthorized disclosure of sensitive information or even remote code execution if the attacker can exploit other vulnerabilities in the system.
The vulnerability affects uWSGI versions prior to 2.0.17. It is recommended to upgrade to version 2.0.17 or later to mitigate the risk.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fixes to prevent potential exploitation.
Yes, a temporary workaround is to disable the --php-docroot option or ensure that the value provided for this option is properly validated and restricted to the intended document root directory. Please refer to the 'workaround' section for more details.
For more information about this vulnerability, including technical details and the official fix, you can refer to the advisory provided by the Python Package Index (PyPI) advisory database. The link to the advisory is available in the 'affected' section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for uwsgi.
