Skip to content
Fencer Intel
medium —

GHSA-6xv5-86q9-7xr8 json

SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced

published 3y ago modified 2mo ago also GO-2023-2048

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact For Windows users of `github.com/cyphar/filepath-securejoin`, until v0.2.4 it was possible for certain rootfs and path combinations (in particular, where a malicious Unix-style `/`-separated unsafe path was used with a Windows-style rootfs path) to result in generated paths that were outside of the provided rootfs.

It is unclear to what extent this has a practical impact on real users, but given the possible severity of the issue we have released an emergency patch release that resolves this issue.

Thanks to @pjbgf for discovering, debugging, and fixing this issue (as well as writing some tests for it).

### Patches c121231e1276e11049547bee5ce68d5a2cfe2d9b is the patch fixing this issue. v0.2.4 contains the fix.

### Workarounds Users could use `filepath.FromSlash()` on all unsafe paths before passing them to `filepath-securejoin`.

### References See #9.

Patch / fix

  • go github.com/cyphar/filepath-securejoin 0.2.4

Is GHSA-6xv5-86q9-7xr8 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
go github.com/cyphar/filepath-securejoin
<0.2.4
0.2.4

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.