CVE-2022-21682: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the `appstream-util` binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and `--nofilesystem=host`.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 6.5
Published: 2022-01-13T21:15Z
Repository: https://github.com/flatpak/flatpak
Language: XML
Files changed: doc/flatpak-build-finish.xml, doc/flatpak-build.xml, doc/flatpak-override.xml, doc/flatpak-run.xml
Commit date: 2022-01-12 19:48:34 +0100
Commit message: manpages: Document the new details of --nofilesystem behaviour.

Diff: diff --git a/doc/flatpak-build-finish.xml b/doc/flatpak-build-finish.xml
index 81a72452da..95ba5d0cd2 100644
--- a/doc/flatpak-build-finish.xml
+++ b/doc/flatpak-build-finish.xml
@@ -256,10 +256,17 @@
                     application metadata.
                     FILESYSTEM can be one of: home, host, host-os, host-etc, xdg-desktop, xdg-documents, xdg-download,
                     xdg-music, xdg-pictures, xdg-public-share, xdg-templates, xdg-videos,
                     an absolute path, or a homedir-relative path like ~/dir.
                     This option can be used multiple times.
+                </para><para>
+                    In general, "--nofilesystem=PATH" will remove access to a specific path if exactly that path
+                    was previously granted. However, as a special case, "--nofilesystem=home"  will remove access to all
+                    previously granted locations inside the homedir as well, such as "home/some-dir", or "xdg-download",
+                    and "--nofilesystem=host" will remove access to all previously granted locations.
+                    Note: absolute paths that happen to be inside the current users home directory are not considered for
+                    this special case.
                 </para></listitem>
             </varlistentry>
 
             <varlistentry>
                 <term><option>--add-policy=SUBSYSTEM.KEY=VALUE</option></term>
diff --git a/doc/flatpak-build.xml b/doc/flatpak-build.xml
index a48e2acdff..2cc0cc6d07 100644
--- a/doc/flatpak-build.xml
+++ b/doc/flatpak-build.xml
@@ -245,10 +245,17 @@
                     application metadata.
                     <arg choice="plain">FILESYSTEM</arg> can be one of: home, host, host-os, host-etc, xdg-desktop, xdg-documents, xdg-download,
                     xdg-music, xdg-pictures, xdg-public-share, xdg-templates, xdg-videos,
                     an absolute path, or a homedir-relative path like ~/dir.
                     This option can be used multiple times.
+                </para><para>
+                    In general, "--nofilesystem=PATH" will remove access to a specific path if exactly that path
+                    was previously granted. However, as a special case, "--nofilesystem=home" will remove access to all
+                    previously granted locations inside the homedir as well, such as "home/some-dir", or "xdg-download",
+                    and "--nofilesystem=host" will remove access to all previously granted locations.
+                    Note: absolute paths that happen to be inside the current users home directory are not considered for
+                    this special case.
                 </para></listitem>
             </varlistentry>
 
             <varlistentry>
                 <term><option>--with-appdir</option></term>
diff --git a/doc/flatpak-override.xml b/doc/flatpak-override.xml
index e2768a4293..0695b32f5a 100644
--- a/doc/flatpak-override.xml
+++ b/doc/flatpak-override.xml
@@ -228,10 +228,17 @@
                     application metadata.
                     <arg choice="plain">FILESYSTEM</arg> can be one of: home, host, host-os, host-etc, xdg-desktop, xdg-documents, xdg-download,
                     xdg-music, xdg-pictures, xdg-public-share, xdg-templates, xdg-videos,
                     an absolute path, or a homedir-relative path like ~/dir.
                     This option can be used multiple times.
+                </para><para>
+                    In general, "--nofilesystem=PATH" will remove access to a specific path if exactly that path
+                    was previously granted. However, as a special case, "--nofilesystem=home" will remove access to all
+                    previously granted locations inside the homedir as well, such as "home/some-dir", or "xdg-download",
+                    and "--nofilesystem=host" will remove access to all previously granted locations.
+                    Note: absolute paths that happen to be inside the current users home directory are not considered for
+                    this special case.
                 </para></listitem>
             </varlistentry>
 
             <varlistentry>
                 <term><option>--add-policy=SUBSYSTEM.KEY=VALUE</option></term>
diff --git a/doc/flatpak-run.xml b/doc/flatpak-run.xml
index 0cdd6ed459..803fae2e70 100644
--- a/doc/flatpak-run.xml
+++ b/doc/flatpak-run.xml
@@ -379,11 +379,19 @@
                     application metadata.
                     <arg choice="plain">FILESYSTEM</arg> can be one of: home, host, host-os, host-etc, xdg-desktop, xdg-documents, xdg-download,
                     xdg-music, xdg-pictures, xdg-public-share, xdg-templates, xdg-videos,
                     an absolute path, or a homedir-relative path like ~/dir.
                     This option can be used multiple times.
+                </para><para>
+                    In general, "--nofilesystem=PATH" will remove access to a specific path if exactly that path
+                    was previously granted. However, as a special case, "--nofilesystem=home" will remove access to all
+                    previously granted locations inside the homedir as well, such as "home/some-dir", or "xdg-download",
+                    and "--nofilesystem=host" will remove access to all previously granted locations.
+                    Note: absolute paths that happen to be inside the current users home directory are not considered for
+                    this special case.
                 </para></listitem>
+
             </varlistentry>
 
             <varlistentry>
                 <term><option>--add-policy=SUBSYSTEM.KEY=VALUE</option></term>
 

Fixed code:                 </para><para>
                    In general, "--nofilesystem=PATH" will remove access to a specific path if exactly that path
                    was previously granted. However, as a special case, "--nofilesystem=home"  will remove access to all
                    previously granted locations inside the homedir as well, such as "home/some-dir", or "xdg-download",
                    and "--nofilesystem=host" will remove access to all previously granted locations.
                    Note: absolute paths that happen to be inside the current users home directory are not considered for
                    this special case.
                </para><para>
                    In general, "--nofilesystem=PATH" will remove access to a specific path if exactly that path
                    was previously granted. However, as a special case, "--nofilesystem=home" will remove access to all
                    previously granted locations inside the homedir as well, such as "home/some-dir", or "xdg-download",
                    and "--nofilesystem=host" will remove access to all previously granted locations.
                    Note: absolute paths that happen to be inside the current users home directory are not considered for
                    this special case.
                </para><para>
                    In general, "--nofilesystem=PATH" will remove access to a specific path if exactly that path
                    was previously granted. However, as a special case, "--nofilesystem=home" will remove access to all
                    previously granted locations inside the homedir as well, such as "home/some-dir", or "xdg-download",
                    and "--nofilesystem=host" will remove access to all previously granted locations.
                    Note: absolute paths that happen to be inside the current users home directory are not considered for
                    this special case.
                </para><para>
                    In general, "--nofilesystem=PATH" will remove access to a specific path if exactly that path
                    was previously granted. However, as a special case, "--nofilesystem=home" will remove access to all
                    previously granted locations inside the homedir as well, such as "home/some-dir", or "xdg-download",
                    and "--nofilesystem=host" will remove access to all previously granted locations.
                    Note: absolute paths that happen to be inside the current users home directory are not considered for
                    this special case.