CVE-2018-25068: Exposure of Resource to Wrong Sphere (CWE-668)
value: A vulnerability has been found in devent globalpom-utils up to 4.5.0 and classified as critical. This vulnerability affects the function createTmpDir of the file globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/FileResourceManagerProvider.java. The manipulation leads to insecure temporary file. The attack can be initiated remotely. Upgrading to version 4.5.1 is able to address this issue. The patch is identified as 77a820bac2f68e662ce261ecb050c643bd7ee560. It is recommended to upgrade the affected component. VDB-217570 is the identifier assigned to this vulnerability.
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 9.8
Published: 2023-01-06T21:15Z
Repository: https://github.com/devent/globalpom-utils
Language: Java
Files changed: globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/FileResourceManagerProvider.java
Commit date: 2018-10-10 12:02:07 +0200
Commit message: Feature #4100 Fix critical Vulnerability

"File.createTempFile" should not be used to create a directory

Diff: diff --git a/globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/FileResourceManagerProvider.java b/globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/FileResourceManagerProvider.java
index a5db9e5..3c393dc 100644
--- a/globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/FileResourceManagerProvider.java
+++ b/globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/FileResourceManagerProvider.java
@@ -1,20 +1,5 @@
-/*
- * Copyright 2016 Erwin Müller <erwin.mueller@deventm.org>
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
 package com.anrisoftware.globalpom.fileresourcemanager;
 
 /*-
  * #%L
  * Global POM Utilities :: File Resources Manager
@@ -22,13 +7,13 @@ package com.anrisoftware.globalpom.fileresourcemanager;
  * Copyright (C) 2013 - 2018 Advanced Natural Research Institute
  * %%
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
@@ -37,10 +22,11 @@ package com.anrisoftware.globalpom.fileresourcemanager;
 
 import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
 import java.io.PrintWriter;
+import java.nio.file.Files;
 
 import javax.inject.Inject;
 
 import org.apache.commons.transaction.file.FileResourceManager;
 import org.apache.commons.transaction.util.LoggerFacade;
@@ -49,79 +35,72 @@ import org.apache.commons.transaction.util.PrintWriterLogger;
 import com.google.inject.Provider;
 
 /**
  * Provides the file resource manager for ACID file operations. The store
  * directory must be set before creating the manager.
- * 
+ *
  * @author Erwin Mueller, erwin.mueller@deventm.org
  * @since 1.8
  */
-public class FileResourceManagerProvider implements
-		Provider<FileResourceManager> {
+public class FileResourceManagerProvider implements Provider<FileResourceManager> {
 
-	@Inject
-	private FileResourceManagerProviderLogger log;
+    @Inject
+    private FileResourceManagerProviderLogger log;
 
-	private String storeDir;
+    private String storeDir;
 
-	private boolean debug;
+    private boolean debug;
 
-	/**
-	 * Sets debug enabled for the file resource manager.
-	 * 
-	 * @param debug
-	 *            set to {@code true} to enable debug before creating the
-	 *            manager.
-	 */
-	public void setDebug(boolean debug) {
-		this.debug = debug;
-	}
+    /**
+     * Sets debug enabled for the file resource manager.
+     *
+     * @param debug set to {@code true} to enable debug before creating the manager.
+     */
+    public void setDebug(boolean debug) {
+        this.debug = debug;
+    }
 
-	/**
-	 * Sets the store directory path for the file resource manager.
-	 * 
-	 * @param path
-	 *            the store directory {@link File} path.
-	 */
-	public void setStoreDir(File path) {
-		setStoreDir(path.getAbsolutePath());
-	}
+    /**
+     * Sets the store directory path for the file resource manager.
+     *
+     * @param path the store directory {@link File} path.
+     */
+    public void setStoreDir(File path) {
+        setStoreDir(path.getAbsolutePath());
+    }
 
-	/**
-	 * Sets the store directory path for the file resource manager.
-	 * 
-	 * @param path
-	 *            the store directory path.
-	 */
-	public void setStoreDir(String path) {
-		this.storeDir = path;
-	}
+    /**
+     * Sets the store directory path for the file resource manager.
+     *
+     * @param path the store directory path.
+     */
+    public void setStoreDir(String path) {
+        this.storeDir = path;
+    }
 
-	@Override
-	public FileResourceManager get() {
-		String workDir = createTmpDir();
-		boolean urlEncodePath = false;
-		final ByteArrayOutputStream stream = new ByteArrayOutputStream(1024);
-		PrintWriter printWriter = new PrintWriter(stream) {
-			@Override
-			public void flush() {
-				super.flush();
-				log.logFileResourceMessage(stream.toString());
-			}
-		};
-		LoggerFacade logger = new PrintWriterLogger(printWriter, "", debug);
-		return new FileResourceManager(storeDir, workDir, urlEncodePath, logger);
-	}
+    @Override
+    public FileResourceManager get() {
+        String workDir = createTmpDir();
+        boolean urlEncodePath = false;
+        final ByteArrayOutputStream stream = new ByteArrayOutputStream(1024);
+        PrintWriter printWriter = new PrintWriter(stream) {
+            @Override
+            public void flush() {
+                super.flush();
+                log.logFileResourceMessage(stream.toString());
+            }
+        };
+        LoggerFacade logger = new PrintWriterLogger(printWriter, "", debug);
+        return new FileResourceManager(storeDir, workDir, urlEncodePath, logger);
+    }
 
-	private String createTmpDir() {
-		try {
-			File tmp = File.createTempFile("fileresourcemanager", null);
-			tmp.delete();
-			tmp.mkdir();
-			String workDir = tmp.getAbsolutePath();
-			return workDir;
-		} catch (IOException e) {
-			throw log.errorCreateWorkDir(e);
-		}
-	}
+    private String createTmpDir() {
+        try {
+            File tmp = Files.createTempDirectory("fileresourcemanager").toFile();
+            String workDir = tmp.getAbsolutePath();
+            return workDir;
+        } catch (IOException e) {
+            throw log.errorCreateWorkDir(e);
+        }
+    }
 
 }

Vulnerable code: /*
 * Copyright 2016 Erwin Müller <erwin.mueller@deventm.org>
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
 * 
 * 
 * 
public class FileResourceManagerProvider implements
		Provider<FileResourceManager> {
	@Inject
	private FileResourceManagerProviderLogger log;
	private String storeDir;
	private boolean debug;
	/**
	 * Sets debug enabled for the file resource manager.
	 * 
	 * @param debug
	 *            set to {@code true} to enable debug before creating the
	 *            manager.
	 */
	public void setDebug(boolean debug) {
		this.debug = debug;
	}
	/**
	 * Sets the store directory path for the file resource manager.
	 * 
	 * @param path
	 *            the store directory {@link File} path.
	 */
	public void setStoreDir(File path) {
		setStoreDir(path.getAbsolutePath());
	}
	/**
	 * Sets the store directory path for the file resource manager.
	 * 
	 * @param path
	 *            the store directory path.
	 */
	public void setStoreDir(String path) {
		this.storeDir = path;
	}
	@Override
	public FileResourceManager get() {
		String workDir = createTmpDir();
		boolean urlEncodePath = false;
		final ByteArrayOutputStream stream = new ByteArrayOutputStream(1024);
		PrintWriter printWriter = new PrintWriter(stream) {
			@Override
			public void flush() {
				super.flush();
				log.logFileResourceMessage(stream.toString());
			}
		};
		LoggerFacade logger = new PrintWriterLogger(printWriter, "", debug);
		return new FileResourceManager(storeDir, workDir, urlEncodePath, logger);
	}
	private String createTmpDir() {
		try {
			File tmp = File.createTempFile("fileresourcemanager", null);
			tmp.delete();
			tmp.mkdir();
			String workDir = tmp.getAbsolutePath();
			return workDir;
		} catch (IOException e) {
			throw log.errorCreateWorkDir(e);
		}
	}
Fixed code:  *
 *
import java.nio.file.Files;
 *
public class FileResourceManagerProvider implements Provider<FileResourceManager> {
    @Inject
    private FileResourceManagerProviderLogger log;
    private String storeDir;
    private boolean debug;
    /**
     * Sets debug enabled for the file resource manager.
     *
     * @param debug set to {@code true} to enable debug before creating the manager.
     */
    public void setDebug(boolean debug) {
        this.debug = debug;
    }
    /**
     * Sets the store directory path for the file resource manager.
     *
     * @param path the store directory {@link File} path.
     */
    public void setStoreDir(File path) {
        setStoreDir(path.getAbsolutePath());
    }
    /**
     * Sets the store directory path for the file resource manager.
     *
     * @param path the store directory path.
     */
    public void setStoreDir(String path) {
        this.storeDir = path;
    }
    @Override
    public FileResourceManager get() {
        String workDir = createTmpDir();
        boolean urlEncodePath = false;
        final ByteArrayOutputStream stream = new ByteArrayOutputStream(1024);
        PrintWriter printWriter = new PrintWriter(stream) {
            @Override
            public void flush() {
                super.flush();
                log.logFileResourceMessage(stream.toString());
            }
        };
        LoggerFacade logger = new PrintWriterLogger(printWriter, "", debug);
        return new FileResourceManager(storeDir, workDir, urlEncodePath, logger);
    }
    private String createTmpDir() {
        try {
            File tmp = Files.createTempDirectory("fileresourcemanager").toFile();
            String workDir = tmp.getAbsolutePath();
            return workDir;
        } catch (IOException e) {
            throw log.errorCreateWorkDir(e);
        }
    }