Vulnerability · Published Jul 16, 2021 · Assigned by GitHub_M
CVE-2021-32769Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-core
High 7.5
In plain English
A high-severity path traversal in micronaut-core from micronaut-projects. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versions prior to 2.5.9. With a basic configuration, it is possible to access any file from a filesystem, using "/../../" in the URL. This occurs because Micronaut does not restrict file access to configured paths. The vulnerability is patched in version 2.5.9. As a workaround, do not use `**` in mapping, use only `*`, which exposes only flat structure of a directory not allowing traversal. If using Linux, another workaround is to run micronaut in chroot.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | io.micronaut:micronaut-http-server-netty | 2.5.9 | GHSA-cjx7-399x-p2rj |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| micronaut-projects | micronaut-core | < 2.5.9 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N