Path traversal in fasthttp - CVE-2022-21221
Published: March 27, 2024
Vulnerability identifier: #VU87847
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-21221
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to insufficient sanitization of user-supplied passed via the ServeFile function. A remote attacker can use a backslash %5c character in the path and read contents of arbitrary files on the system.
Affected software
fasthttp
IBM Cloud Pak for Watson AIOps
IBM Cloud Pak for Watson AIOps
How to mitigate CVE-2022-21221
Cybersecurity Help is currently unaware of any official solution to address this vulnerability..
fasthttp - update to 1.34.0
IBM Cloud Pak for Watson AIOps - update to 4.4.0
IBM Cloud Pak for Watson AIOps - update to 4.4.0
External References
- https://github.com/valyala/fasthttp/commit/15262ecf3c602364639d465daba1e7f3604d00e8
- https://github.com/valyala/fasthttp/issues/1226
- https://github.com/valyala/fasthttp/commit/6b5bc7bb304975147b4af68df54ac214ed2554c1
- https://github.com/valyala/fasthttp/releases/tag/v1.34.0
- https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866