CVE-2022-3952: Exposure of Resource to Wrong Sphere (CWE-668)
value: A vulnerability has been found in ManyDesigns Portofino 5.3.2 and classified as problematic. Affected by this vulnerability is the function createTempDir of the file WarFileLauncher.java. The manipulation leads to creation of temporary file in directory with insecure permissions. Upgrading to version 5.3.3 is able to address this issue. The name of the patch is 94653cb357806c9cf24d8d294e6afea33f8f0775. It is recommended to upgrade the affected component. The identifier VDB-213457 was assigned to this vulnerability.
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 7.1
Published: 2022-11-11T14:15Z
Repository: https://github.com/ManyDesigns/Portofino
Language: Java
Files changed: microservices/launcher/src/main/java/com/manydesigns/portofino/microservices/launcher/WarFileLauncher.java
Commit date: 2022-10-04 00:22:10 +0000
Commit message: vuln-fix: Temporary Directory Hijacking or Information Disclosure



This fixes either Temporary Directory Hijacking, or Temporary Directory Local Information Disclosure.

Weakness: CWE-379: Creation of Temporary File in Directory with Insecure Permissions
Severity: High
CVSSS: 7.3
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.UseFilesCreateTempDirectory)

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/10


Co-authored-by: Moderne <team@moderne.io>
Diff: diff --git a/microservices/launcher/src/main/java/com/manydesigns/portofino/microservices/launcher/WarFileLauncher.java b/microservices/launcher/src/main/java/com/manydesigns/portofino/microservices/launcher/WarFileLauncher.java
index 5e8ea8c8e..dec746aef 100644
--- a/microservices/launcher/src/main/java/com/manydesigns/portofino/microservices/launcher/WarFileLauncher.java
+++ b/microservices/launcher/src/main/java/com/manydesigns/portofino/microservices/launcher/WarFileLauncher.java
@@ -7,10 +7,11 @@ import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URL;
 import java.net.URLClassLoader;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Enumeration;
 import java.util.List;
 import java.util.jar.JarEntry;
 import java.util.jar.JarFile;
@@ -78,13 +79,11 @@ public class WarFileLauncher {
 
     /**
      * Returns the absolute path to the temp directory.
      */
     public static File createTempDir(int port) throws IOException {
-        File tempDir = File.createTempFile("portofino.tomcat.", "." + port);
-        tempDir.delete();
-        tempDir.mkdir();
+        File tempDir = Files.createTempDirectory("portofino.tomcat." + "." + port).toFile();
         tempDir.deleteOnExit();
         return tempDir;
     }
 
 }

Vulnerable code:         File tempDir = File.createTempFile("portofino.tomcat.", "." + port);
        tempDir.delete();
        tempDir.mkdir();
Fixed code: import java.nio.file.Files;
        File tempDir = Files.createTempDirectory("portofino.tomcat." + "." + port).toFile();