CVE-2021-3907CWE-20CWE-22
Arbitrary filepath traversal via URI injection
High · published November 11, 2021
What it is
OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.
The record
Technical detail
- CVSS v3.1
- 7.4 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.04199 · 90.9th percentile
- Weaknesses
- CWE-20 · Improper Input Validation; CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Published
- 2021-11-11T21:45Z
EPSS history
Timeline