CVE-2024-24042 (published 2024-03-19T07:15Z)

Directory Traversal vulnerability in Devan-Kerman ARRP v.0.8.1 and before allows a remote attacker to execute arbitrary code via the dumpDirect in RuntimeResourcePackImpl component.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Devan-Kerman/ARRP
commit_details: repo_url: https://github.com/Devan-Kerman/ARRP
author: ueaj
author_date: 2024-01-08 19:01:54-06:00
msg: oops v0.8.2
repository: repo_url: https://github.com/Devan-Kerman/ARRP
repo_name: Devan-Kerman/ARRP
description: A fabric api for creating resources and assets at runtime
repo_language: Java
owner: Devan-Kerman
file_changes: filename: gradle.properties
change_type: ModificationType.MODIFY
diff: @@ -8,7 +8,7 @@ loader_version=0.14.21
 fabric_version=0.84.0+1.20.1
 
 # Mod Properties
-mod_version=0.8.0
+mod_version=0.8.1
 maven_group=net.devtech
 archives_base_name=arrp
 # Dependencies

programming_language: Shell
filename: RuntimeResourcePackImpl.java
change_type: ModificationType.MODIFY
diff: @@ -303,7 +303,7 @@ public class RuntimeResourcePackImpl implements RuntimeResourcePack, ResourcePac
 			for(Map.Entry<List<String>, Supplier<byte[]>> e : this.root.entrySet()) {
 				String pathStr = String.join("/", e.getKey());
 				Path path = output.resolve(pathStr);
-				if(path.startsWith(output)) {
+				if(path.toAbsolutePath().startsWith(output.toAbsolutePath())) {
 					Files.createDirectories(path.getParent());
 					Files.write(path, e.getValue().get());
 				} else {
@@ -554,7 +554,7 @@ public class RuntimeResourcePackImpl implements RuntimeResourcePack, ResourcePac
 			String namespace = identifier.getNamespace();
 			String path = identifier.getPath();
 			Path file = dir.resolve(namespace).resolve(path);
-			if(file.startsWith(dir)) {
+			if(file.toAbsolutePath().startsWith(dir.toAbsolutePath())) {
 				Files.createDirectories(file.getParent());
 				try(OutputStream output = Files.newOutputStream(file)) {
 					output.write(data);

programming_language: Java
filename: RRPPreTest.java
change_type: ModificationType.MODIFY
diff: @@ -16,6 +16,7 @@ import static net.devtech.arrp.json.models.JModel.textures;
 
 import com.google.gson.Gson;
 import com.google.gson.GsonBuilder;
+import net.devtech.arrp.api.RuntimeResourcePack;
 import net.devtech.arrp.impl.RuntimeResourcePackImpl;
 import net.devtech.arrp.json.blockstate.JMultipart;
 import net.devtech.arrp.json.blockstate.JState;
@@ -27,9 +28,14 @@ import net.devtech.arrp.json.models.JTextures;
 
 import net.minecraft.util.Identifier;
 import net.minecraft.util.math.Direction;
+import java.nio.file.Path;
 
 public class RRPPreTest {
 	public static void main(String[] args) {
+		RuntimeResourcePack pack = RuntimeResourcePack.create("test:test");
+		pack.addLang(new Identifier("aaaa:aaaa"), new JLang().entry("aaaa", "bbbbb"));
+		pack.dumpDirect(Path.of("aaaa"));
+
 		JState iron_block = state(variant(JState.model("block/iron_block")));
 		JState oak_fence = state(multipart(JState.model("block/oak_fence_post")),
 				multipart(JState.model("block/oak_fence_side").uvlock()).when(when().add("north", "true")),
@@ -47,6 +53,8 @@ public class RRPPreTest {
 		                                                      .west(face("all").uv(9, 0, 11, 16))
 		                                                      .east(face("all").uv(9, 0, 11, 16))));
 
+
+
 		Gson gson = new GsonBuilder().registerTypeAdapter(JMultipart.class, new JMultipart.Serializer())
 		                             .registerTypeAdapter(JWhen.class, new JWhen.Serializer())
 		                             .registerTypeAdapter(JState.class, new JState.Serializer())

programming_language: Java