CVE Vulnerability

CVE-2021-43795

Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/line/armeria/pull/3855 Third Party Advisory
https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284 Patch Third Party Advisory
https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:linecorp:armeria:*:*:*:*:*:*:*:*
Information

Published : 2021-12-02 06:15

Updated : 2021-12-06 06:24

NVD link : CVE-2021-43795

Mitre link : CVE-2021-43795

Products Affected
No products.
CWE
CWE-22