[Security] Path Traversal In Windows

[LLfam]

Hi, I think there is a potential vul in io.vertx.ext.web.handler.StaticHandler.

Example code:
https://github.com/vert-x3/vertx-examples/blob/3.x/web-examples/src/main/java/io/vertx/example/web/staticsite/Server.java

Use PoC below will lead to Path Traversal in Windows
PoC:
http://ip:8080/%5c..%5cServer.java

%5c..%5c is a legitimate path for the URI spec. But in Handler, directly use it to find some resources is not security.

In io.vertx.ext.web.handler.impl.StaticHandlerImpl#handle, io.vertx.core.http.impl.HttpUtils#removeDots just sanitize /../ without considering \..\. So it will lead a Path Traversal in Windows.

[tmousaw-ptc]

Any chance that this will be backported to a 3.9.x patch release since this has a pretty high CVSS score per Sonatype?

[LLfam]

Hi, when I search CVE for this issue, i found CVE-2018-12542.
The vul I found is same as vul mentioned in issue#1025. This vul is fixed in Release 3.5.4. But Release 3.6.0+ is same as 3.5.3 that vul isn't fixed.
I don't know how it is caused.

[vietj]

yes it will be backported and released in 3.9.4

…

On Wed, Oct 7, 2020 at 3:49 PM tmousaw-ptc ***@***.***> wrote: Any chance that this will be backported to a 3.9.x patch release since this has a pretty high CVSS score per Sonatype? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#1714 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABXDCVJHZISTV2T4L3VUPLSJRWWFANCNFSM4R2VLVAQ> .

[vietj]

This has been recorded as CVE-2019-17640