Path traversal in TestNG - CVE-2022-4065

Vulnerability identifier: #VU74202

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-4065

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the testngXmlExistsInJar() function in testng-core/src/main/java/org/testng/JarFileUtils.java of the XML File Parser component. A remote attacker can pass specially crafted XML file to the application and overwrite arbitrary files on the system.

TestNG
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server Module
SUSE Enterprise Storage
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
Development Tools Module
SUSE Package Hub 15
openSUSE Leap
openEuler
Anolis OS
openapi-generator
UrbanCode Build
snakeyaml
snakeyaml-javadoc
mockito
mockito-javadoc
testng
testng-javadoc

Install update from vendor's website.

TestNG - update to 7.7.0
openapi-generator - update to 7.6.0
snakeyaml - update to 2.2-150200.3.15.1
snakeyaml-javadoc - update to 2.2-150200.3.15.1
mockito - update to 5.11.0-150200.3.7.1
mockito-javadoc - update to 5.11.0-150200.3.7.1
UrbanCode Build - update to 6.1.7.10
testng - update to 6.14.3-7
testng-javadoc - update to 6.14.3-7
testng-javadoc - addressed in versions 7.4.0-150200.3.7.1, 7.10.1-150200.3.10.1
testng - addressed in versions 7.4.0-150200.3.7.1, 7.10.1-150200.3.10.1
testng - update to 7.6.1-3
testng-javadoc - update to 7.6.1-3

• https://github.com/cbeust/testng/commit/9150736cd2c123a6a3b60e6193630859f9f0422b
• https://github.com/cbeust/testng/pull/2806
• https://vuldb.com/?id.214027

• Path traversal in TestNG testing framework
• SUSE update for testng
• Multiple vulnerabilities in IBM UrbanCode Build
• openEuler update for testng
• openapi-generator update for TestNG
• SUSE update for mockito, snakeyaml, testng
• Anolis OS update for testng