Mojolicious Directory Traversal Vulnerability

Bugtraq ID:	47402
Class:	Input Validation Error
CVE:	CVE-2011-1589
Remote:	Yes
Local:	No
Published:	Apr 18 2011 12:00AM
Updated:	May 07 2015 05:11PM
Credit:	Viacheslav Tykhanovskyi
Vulnerable:	Mojolicious Mojolicious 1.15 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:	Mojolicious Mojolicious 1.16

Mojolicious Directory Traversal Vulnerability

Mojolicious is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary local files within the context of the webserver. Information harvested may aid in launching further attacks.

Mojolicious versions prior to 1.16 are vulnerable.

Mojolicious Directory Traversal Vulnerability

An attacker can exploit this issue with a web browser.

Mojolicious Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references for more information.

Mojolicious Directory Traversal Vulnerability

References:

• Mojolicious Homepage (Mojolicious)
  
• Mojolicious Release Notes (CPAN)
  
• Path security vulnerability - GitHub (github)