Path traversal in Sphinx - CVE-2020-29050

Vulnerability identifier: #VU59364

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-29050

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences, because the mysql client can be used for CALL SNIPPETS and load_file operations on a full pathname (e.g., a file in the /etc directory). A remote user can send a specially crafted HTTP request and read arbitrary files on the system.

Please note, the affected version does not require authentication by default (see vulnerability #VU59363) and therefore the vulnerability can be exploited by a remote non-authenticated attacker in the default configuration.

Sphinx
sphinxsearch (Debian package)
sphinx
libsphinxclient-devel
sphinx-php
libsphinxclient
sphinx-debuginfo
sphinx-java
sphinx-debugsource
sphinx-help
openEuler

Install update from vendor's website.

Sphinx - update to 3.2.1
sphinxsearch (Debian package) - update to 2.2.11-2+deb10u1
sphinx - update to 2.2.11-2
libsphinxclient-devel - update to 2.2.11-2
sphinx-php - update to 2.2.11-2
libsphinxclient - update to 2.2.11-2
sphinx-debuginfo - update to 2.2.11-2
sphinx-java - update to 2.2.11-2
sphinx-debugsource - update to 2.2.11-2
sphinx-help - update to 2.2.11-2

• https://security-tracker.debian.org/tracker/CVE-2020-29050
• https://blog.wirhabenstil.de/2019/08/19/sphinxsearch-0-0-0-09306-cve-2019-14511/

• Path traversal in Sphinx
• Debian update for sphinxsearch
• openEuler update for sphinx