UNIX symbolic link following in Harp - CVE-2019-5438
Published: May 14, 2019
Vulnerability identifier: #VU18439
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-5438
CWE-ID: CWE-61
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to sensitive data.
The vulnerability exists due to a symlink following issue when processing path traversal characters. A local user can create a specially crafted symbolic link to get access to files outside project directory.
Successful exploitation of this vulnerability allows to list any file in another folder of web root.
Affected software
Harp
How to mitigate CVE-2019-5438
Install updates from vendor's website.
Harp - update to 0.30.0