QID 981958
QID 981958: Java (maven) Security Update for io.micronaut:micronaut-http-server-netty (GHSA-cjx7-399x-p2rj)
With a basic configuration like
```yaml
router:
static-resources:
assets:
enabled: true
mapping: /.assets/public/**
paths: file:/home/lstrmiska/test/
```
it is possible to access any file from a filesystem, using "/../../" in URL, as Micronaut does not restrict file access to configured paths.
**Repro Steps**
- create a file test.txt in /home/lstrmiska
- start micronaut
- execute command
`curl -v --path-as-is "http://localhost:8080/.assets/public/../test.txt"`
Micronaut can potentially leak sensitive information.
See https://cwe.mitre.org/data/definitions/22.html
Solution
```
diff --git a/core/src/main/java/io/micronaut/core/io/file/DefaultFileSystemResourceLoader.java b/core/src/main/java/io/micronaut/core/io/file/DefaultFileSystemResourceLoader.java
index 2f5a91403..19d3b7f05 100644
--- a/core/src/main/java/io/micronaut/core/io/file/DefaultFileSystemResourceLoader.java
+++ b/core/src/main/java/io/micronaut/core/io/file/DefaultFileSystemResourceLoader.java
@@ -69,6 +69,9 @@ public class DefaultFileSystemResourceLoader implements FileSystemResourceLoader
@Override
public Optional<InputStream> getResourceAsStream(String path) {
Path filePath = getFilePath(normalize(path));
+ if (pathOutsideBase(filePath)) {
+ return Optional.empty();
+ }
try {
return Optional.of(Files.newInputStream(filePath));
} catch (IOException e) {
@@ -79,7 +82,7 @@ public class DefaultFileSystemResourceLoader implements FileSystemResourceLoader
@Override
public Optional<URL> getResource(String path) {
Path filePath = getFilePath(normalize(path));
- if (Files.exists(filePath) && Files.isReadable(filePath) && !Files.isDirectory(filePath)) {
+ if (!pathOutsideBase(filePath) && Files.exists(filePath) && Files.isReadable(filePath) && !Files.isDirectory(filePath)) {
try {
URL url = filePath.toUri().toURL();
return Optional.of(url);
@@ -117,4 +120,15 @@ public class DefaultFileSystemResourceLoader implements FileSystemResourceLoader
private Path getFilePath(String path) {
return baseDirPath.map(dir -> dir.resolve(path)).orElseGet(() -> Paths.get(path));
}
+
+ private boolean pathOutsideBase(Path path) {
+ if (baseDirPath.isPresent()) {
+ Path baseDir = baseDirPath.get();
+ if (path.isAbsolute() == baseDir.isAbsolute()) {
+ Path relativePath = baseDir.relativize(path);
+ return relativePath.startsWith("..");
+ }
+ }
+ return false;
+ }
}
--
```Workaround:
- do not use ** in mapping, use only * which exposes only flat structure of a directory not allowing traversal
- run micronaut in chroot (linux only)
diff --git a/core/src/main/java/io/micronaut/core/io/file/DefaultFileSystemResourceLoader.java b/core/src/main/java/io/micronaut/core/io/file/DefaultFileSystemResourceLoader.java
index 2f5a91403..19d3b7f05 100644
--- a/core/src/main/java/io/micronaut/core/io/file/DefaultFileSystemResourceLoader.java
+++ b/core/src/main/java/io/micronaut/core/io/file/DefaultFileSystemResourceLoader.java
@@ -69,6 +69,9 @@ public class DefaultFileSystemResourceLoader implements FileSystemResourceLoader
@Override
public Optional<InputStream> getResourceAsStream(String path) {
Path filePath = getFilePath(normalize(path));
+ if (pathOutsideBase(filePath)) {
+ return Optional.empty();
+ }
try {
return Optional.of(Files.newInputStream(filePath));
} catch (IOException e) {
@@ -79,7 +82,7 @@ public class DefaultFileSystemResourceLoader implements FileSystemResourceLoader
@Override
public Optional<URL> getResource(String path) {
Path filePath = getFilePath(normalize(path));
- if (Files.exists(filePath) && Files.isReadable(filePath) && !Files.isDirectory(filePath)) {
+ if (!pathOutsideBase(filePath) && Files.exists(filePath) && Files.isReadable(filePath) && !Files.isDirectory(filePath)) {
try {
URL url = filePath.toUri().toURL();
return Optional.of(url);
@@ -117,4 +120,15 @@ public class DefaultFileSystemResourceLoader implements FileSystemResourceLoader
private Path getFilePath(String path) {
return baseDirPath.map(dir -> dir.resolve(path)).orElseGet(() -> Paths.get(path));
}
+
+ private boolean pathOutsideBase(Path path) {
+ if (baseDirPath.isPresent()) {
+ Path baseDir = baseDirPath.get();
+ if (path.isAbsolute() == baseDir.isAbsolute()) {
+ Path relativePath = baseDir.relativize(path);
+ return relativePath.startsWith("..");
+ }
+ }
+ return false;
+ }
}
--
```Workaround:
- do not use ** in mapping, use only * which exposes only flat structure of a directory not allowing traversal
- run micronaut in chroot (linux only)
Vendor References
- GHSA-cjx7-399x-p2rj -
github.com/advisories/GHSA-cjx7-399x-p2rj
CVEs related to QID 981958
Software Advisories
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-cjx7-399x-p2rj | io.micronaut:micronaut-http-server-netty |
github.com/advisories/GHSA-cjx7-399x-p2rj |