CVE-2022-24823 (published 2022-05-06T12:15Z)

Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.

Severity: LOW
CVSS v2 base score: 1.9 (AV:L/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-668
cwe_name: Exposure of Resource to Wrong Sphere
description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
extended_description: 
            Resources such as files and directories may be inadvertently exposed through mechanisms such as insecure permissions, or when a program accidentally operates on the wrong object. For example, a program may intend that private files can only be provided to a specific user. This effectively defines a control sphere that is intended to prevent attackers from accessing these private files. If the file permissions are insecure, then parties other than the user will be able to access those files.
            A separate control sphere might effectively require that the user can only access the private files, but not any other files on the system. If the program does not ensure that the user is only requesting private files, then the user might be able to access other files on the system.
            In either case, the end result is that a resource has been exposed to the wrong party.
         
         
cwe_id: CWE-378
cwe_name: Creation of Temporary File With Insecure Permissions
description: Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
extended_description: 
            
         
         
cwe_id: CWE-379
cwe_name: Creation of Temporary File in Directory with Insecure Permissions
description: The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
extended_description: On some operating systems, the fact that the temporary file exists may be apparent to any user with sufficient privileges to access that directory. Since the file is visible, the application that is using the temporary file could be known. If one has access to list the processes on the system, the attacker has gained information about what the user is doing at that time. By correlating this with the applications the user is running, an attacker could potentially discover what a user's actions are. From this, higher levels of security could be breached.
         

Fix information:
repo_url: https://github.com/netty/netty
commit_details: repo_url: https://github.com/netty/netty
author: Norman Maurer
author_date: 2022-05-06 08:57:43+02:00
msg: Merge pull request from GHSA-269q-hmxg-m83q

* Correctly modify permission for temporary files when using Java 6 in all cases

Motivation:

[GHSA-5mcr-gq6c-3hq2](https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2) did not correctly fix all cases for temprory files when running on java 6.

Modifications:

- Add correctly adjust perms in all cases
- Add logging if adjusting of permissions fails

Result:

Fixes https://github.com/netty/netty/security/advisories/GHSA-269q-hmxg-m83q

* Throw on failure
repository: repo_url: https://github.com/netty/netty
repo_name: netty/netty
description: Netty project - an event-driven asynchronous network application framework
repo_language: Java
owner: netty
file_changes: filename: PlatformDependent.java
change_type: ModificationType.MODIFY
diff: @@ -1447,13 +1447,20 @@ public final class PlatformDependent {
             }
             return Files.createTempFile(directory.toPath(), prefix, suffix).toFile();
         }
+        final File file;
         if (directory == null) {
-            return File.createTempFile(prefix, suffix);
+            file = File.createTempFile(prefix, suffix);
+        } else {
+            file = File.createTempFile(prefix, suffix, directory);
         }
-        File file = File.createTempFile(prefix, suffix, directory);
+
         // Try to adjust the perms, if this fails there is not much else we can do...
-        file.setReadable(false, false);
-        file.setReadable(true, true);
+        if (!file.setReadable(false, false)) {
+            throw new IOException("Failed to set permissions on temporary file " + file);
+        }
+        if (!file.setReadable(true, true)) {
+            throw new IOException("Failed to set permissions on temporary file " + file);
+        }
         return file;
     }
 

programming_language: Java