[
https://issues.apache.org/jira/browse/KNOX-3418?focusedWorklogId=1035775&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1035775
]
ASF GitHub Bot logged work on KNOX-3418:
----------------------------------------
Author: ASF GitHub Bot
Created on: 14/Aug/26 11:03
Start Date: 14/Aug/26 11:03
Worklog Time Spent: 10m
Work Description: hanicz merged PR #1349:
URL: https://github.com/apache/knox/pull/1349
Issue Time Tracking
-------------------
Worklog Id: (was: 1035775)
Time Spent: 0.5h (was: 20m)
> Path traversal → arbitrary file write/overwrite in the Apache Knox Admin API
> ----------------------------------------------------------------------------
>
> Key: KNOX-3418
> URL: https://issues.apache.org/jira/browse/KNOX-3418
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 2.1.0, 3.0.0
> Reporter: Tamás Hanicz
> Assignee: Tamás Hanicz
> Priority: Blocker
> Fix For: 3.1.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> Reported by greybtw
>
> Path traversal in the Knox Admin API resource-management endpoints (PUT
> /admin/api/v1/\{providerconfig,descriptors,topologies}/\{name}). The
> client-supplied resource name is URL-decoded and validated against
> RESOURCE_NAME_PATTERN = ^[\w-/.]+$, whose character class admits / and . (the
> - is literal), so a ../ traversal passes validation. The decoded name is then
> written via new File(dest, name) + FileUtils.writeStringToFile with no
> canonical-path containment check, so an authenticated admin-role user can
> write/overwrite a file outside the managed
> shared-providers/descriptors/topologies directories, with an attacker-chosen
> filename and extension (getFileNameForResource keeps the name verbatim when
> it already has a .)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
