[jira] [Work logged] (KNOX-3418) Path traversal → arbitrary file write/overwrite in the Apache Knox Admin API

[ASF GitHub Bot (Jira)]

     [ 
https://issues.apache.org/jira/browse/KNOX-3418?focusedWorklogId=1035607&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1035607
 ]

ASF GitHub Bot logged work on KNOX-3418:
----------------------------------------

                Author: ASF GitHub Bot
            Created on: 13/Aug/26 13:49
            Start Date: 13/Aug/26 13:49
    Worklog Time Spent: 10m 
      Work Description: github-actions[bot] commented on PR #1349:
URL: https://github.com/apache/knox/pull/1349#issuecomment-5281303574

   ## Test Results
   40 tests   40 ✅  6s ⏱️
    3 suites   0 💤
    3 files     0 ❌
   
   Results for commit f25b4772.
   
   
[test-results]:data:application/gzip;base64,H4sIAEvLfWoC/12MSQ7CMBAEvxL5zCGecXDgM8irNCKJkZcT4u84AbJw66qW6sk8DS6xa4OnhqVCeQVbosoUpornivXI8yXaH9xSMebP3OlRzSa8ouEgXIwhfk0s01qc9yH4EVtv4V1u4X3NhHGkXIF56LSQEnoPF2MtgkSwWigBnGtA5XrD0VlkrzclgkJR/wAAAA==
   




Issue Time Tracking
-------------------

    Worklog Id:     (was: 1035607)
    Time Spent: 20m  (was: 10m)

> Path traversal → arbitrary file write/overwrite in the Apache Knox Admin API
> ----------------------------------------------------------------------------
>
>                 Key: KNOX-3418
>                 URL: https://issues.apache.org/jira/browse/KNOX-3418
>             Project: Apache Knox
>          Issue Type: Bug
>          Components: Server
>    Affects Versions: 2.1.0, 3.0.0
>            Reporter: Tamás Hanicz
>            Assignee: Tamás Hanicz
>            Priority: Blocker
>          Time Spent: 20m
>  Remaining Estimate: 0h
>
> Reported by greybtw
>  
> Path traversal in the Knox Admin API resource-management endpoints (PUT 
> /admin/api/v1/\{providerconfig,descriptors,topologies}/\{name}). The 
> client-supplied resource name is URL-decoded and validated against 
> RESOURCE_NAME_PATTERN = ^[\w-/.]+$, whose character class admits / and . (the 
> - is literal), so a ../ traversal passes validation. The decoded name is then 
> written via new File(dest, name) + FileUtils.writeStringToFile with no 
> canonical-path containment check, so an authenticated admin-role user can 
> write/overwrite a file outside the managed 
> shared-providers/descriptors/topologies directories, with an attacker-chosen 
> filename and extension (getFileNameForResource keeps the name verbatim when 
> it already has a .)



--
This message was sent by Atlassian Jira
(v8.20.10#820010)