Path traversal in onnx - CVE-2022-25882
Published: April 17, 2023 / Updated: March 21, 2024
Vulnerability identifier: #VU75176
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-25882
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
Request example:
http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
Affected software
onnx
Python for Scientific Computing
IBM Watson Machine Learning Accelerator
Watson Studio on Cloud Pak for Data
Python for Scientific Computing
IBM Watson Machine Learning Accelerator
Watson Studio on Cloud Pak for Data
How to mitigate CVE-2022-25882
Install update from vendor's website.
onnx - update to 1.13.0
Python for Scientific Computing - update to 4.2.1
IBM Watson Machine Learning Accelerator - update to 4.0
Watson Studio on Cloud Pak for Data - update to 4.8.0
Python for Scientific Computing - update to 4.2.1
IBM Watson Machine Learning Accelerator - update to 4.0
Watson Studio on Cloud Pak for Data - update to 4.8.0
External References
- https://gist.github.com/jnovikov/02a9aff9bf2188033e77bd91ff062856
- https://github.com/onnx/onnx/issues/3991
- https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-2395479
- https://github.com/onnx/onnx/blob/96516aecd4c110b0ac57eba08ac236ebf7205728/onnx/checker.cc%23L129
- https://github.com/onnx/onnx/commit/f369b0e859024095d721f1d1612da5a8fa38988d
- https://github.com/onnx/onnx/pull/4400