CVE-2022-41954 (Java, published 2022-11-25T19:15Z)
Description: value: MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ's use of `File.createTempFile(..)` results in temporary files being created with the permissions `-rw-r--r--`. This means that any other user on the system can read the contents of this file. When MPXJ is reading a schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ. The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes. Users unable to upgrade may set `java.io.tmpdir` to a directory to which only the user running the application has access will prevent other users from accessing these temporary files.
Severity: nan (CVSS v3 base score: 3.3)
Weakness: CWE-377 \u2014 Insecure Temporary File
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
Repository: https://github.com/joniles/mpxj
Files changed:
src/main/java/net/sf/mpxj/common/FileHelper.java
src/main/java/net/sf/mpxj/common/InputStreamHelper.java
src/test/java/net/sf/mpxj/junit/CustomerDataTest.java
src/test/java/net/sf/mpxj/junit/LocaleTest.java
src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java
Commit message: vuln-fix: Temporary File Information Disclosure



This fixes temporary file information disclosure vulnerability due to the use
of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by
using the `Files.createTempFile()` method which sets the correct posix permissions.

Weakness: CWE-377: Insecure Temporary File
Severity: Medium
CVSSS: 5.5
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18


Co-authored-by: Moderne <team@moderne.io>

Vulnerable code:
      File dir = File.createTempFile("mpxj", "tmp");
         File file = File.createTempFile("mpxj", tempFileSuffix);
      File file = File.createTempFile("primavera", "db");
         File out = File.createTempFile("junit", suffix);
      File out = File.createTempFile("junit-" + locale.getLanguage(), ".mpx");
      File out = File.createTempFile("junit", ".mpx");
      File out = File.createTempFile("junit", ".xml");
      File out = File.createTempFile("junit", ".mpx");
      File out = File.createTempFile("junit", ".mpx");
      File out = File.createTempFile("junit", ".planner");
      File out = File.createTempFile("junit", ".mpx");
      File out = File.createTempFile("junit", ".mpx");
      File out = File.createTempFile("junit", ".mpx");
      File out = File.createTempFile("junit", ".mpx");
      out = File.createTempFile("junit", ".xml");
      File out = File.createTempFile("junit", ".mpx");
      File out = File.createTempFile("junit", ".mpx");
      File out = File.createTempFile("junit", ".mpx");
      File out = File.createTempFile("junit", ".mpx");
      File out = File.createTempFile("junit", ".mpx");
      File out = File.createTempFile("junit", ".xml");
      File out = File.createTempFile("junit", ".xml");
      File out = File.createTempFile("junit", ".mpx");
      File out = File.createTempFile("junit", ".xml");
      File out = File.createTempFile("junit", ".mpx");
      out = File.createTempFile("junit", ".xml");
      File out = File.createTempFile("junit", ".mpx");
      out = File.createTempFile("junit", ".xml");
      File out = File.createTempFile("junit", ".mpx");
      File out = File.createTempFile("junit", ".mpx");

Fixed code:
import java.nio.file.Files;
      File dir = Files.createTempFile("mpxj", "tmp").toFile();
import java.nio.file.Files;
         File file = Files.createTempFile("mpxj", tempFileSuffix).toFile();
      File file = Files.createTempFile("primavera", "db").toFile();
         File out = Files.createTempFile("junit", suffix).toFile();
import java.nio.file.Files;
      File out = Files.createTempFile("junit-" + locale.getLanguage(), ".mpx").toFile();
import java.nio.file.Files;
      File out = Files.createTempFile("junit", ".mpx").toFile();
      File out = Files.createTempFile("junit", ".xml").toFile();
      File out = Files.createTempFile("junit", ".mpx").toFile();
      File out = Files.createTempFile("junit", ".mpx").toFile();
      File out = Files.createTempFile("junit", ".planner").toFile();
      File out = Files.createTempFile("junit", ".mpx").toFile();
      File out = Files.createTempFile("junit", ".mpx").toFile();
      File out = Files.createTempFile("junit", ".mpx").toFile();
      File out = Files.createTempFile("junit", ".mpx").toFile();
      out = Files.createTempFile("junit", ".xml").toFile();
      File out = Files.createTempFile("junit", ".mpx").toFile();
      File out = Files.createTempFile("junit", ".mpx").toFile();
      File out = Files.createTempFile("junit", ".mpx").toFile();
      File out = Files.createTempFile("junit", ".mpx").toFile();
      File out = Files.createTempFile("junit", ".mpx").toFile();
      File out = Files.createTempFile("junit", ".xml").toFile();
      File out = Files.createTempFile("junit", ".xml").toFile();
      File out = Files.createTempFile("junit", ".mpx").toFile();
      File out = Files.createTempFile("junit", ".xml").toFile();
      File out = Files.createTempFile("junit", ".mpx").toFile();
      out = Files.createTempFile("junit", ".xml").toFile();
      File out = Files.createTempFile("junit", ".mpx").toFile();
      out = Files.createTempFile("junit", ".xml").toFile();
      File out = Files.createTempFile("junit", ".mpx").toFile();
      File out = Files.createTempFile("junit", ".mpx").toFile();