CVE-2022-21221
Summary
| CVE | CVE-2022-21221 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-03-17 12:15:00 UTC |
| Updated | 2022-03-24 02:27:00 UTC |
| Description | The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only. |
Risk And Classification
Problem Types: CWE-22
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Fasthttp Project | Fasthttp | All | All | All | All |
| Operating System | Microsoft | Windows | - | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Release v1.34.0 · valyala/fasthttp · GitHub | MISC | github.com | |
| Path Traversal Attacks · Issue #1226 · valyala/fasthttp · GitHub | MISC | github.com | |
| Warn about unsafe ServeFile usage (#1228) · valyala/fasthttp@15262ec · GitHub | MISC | github.com | |
| Directory Traversal in github.com/valyala/fasthttp | CVE-2022-21221 | Snyk | MISC | snyk.io | |
| Add windows support to normalizePath · valyala/fasthttp@6b5bc7b · GitHub | MISC | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: egovorukhin
There are currently no legacy QID mappings associated with this CVE.