Tamás Hanicz created KNOX-3418:
----------------------------------
Summary: Path traversal → arbitrary file write/overwrite in the
Apache Knox Admin API
Key: KNOX-3418
URL: https://issues.apache.org/jira/browse/KNOX-3418
Project: Apache Knox
Issue Type: Bug
Components: Server
Affects Versions: 2.1.0, 3.0.0
Reporter: Tamás Hanicz
Assignee: Tamás Hanicz
Reported by greybtw
Path traversal in the Knox Admin API resource-management endpoints (PUT
/admin/api/v1/\{providerconfig,descriptors,topologies}/\{name}). The
client-supplied resource name is URL-decoded and validated against
RESOURCE_NAME_PATTERN = ^[\w-/.]+$, whose character class admits / and . (the -
is literal), so a ../ traversal passes validation. The decoded name is then
written via new File(dest, name) + FileUtils.writeStringToFile with no
canonical-path containment check, so an authenticated admin-role user can
write/overwrite a file outside the managed
shared-providers/descriptors/topologies directories, with an attacker-chosen
filename and extension (getFileNameForResource keeps the name verbatim when it
already has a .)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
