CVE-2021-23772 (published 2021-12-24T12:15Z)

This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-59
cwe_name: Improper Link Resolution Before File Access ('Link Following')
description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/kataras/iris
commit_details: repo_url: https://github.com/kataras/iris
author: Gerasimos (Makis) Maropoulos
author_date: 2021-12-23 22:05:26+02:00
msg: security fix
repository: repo_url: https://github.com/kataras/iris
repo_name: kataras/iris
description: The fastest HTTP/2 Go Web Framework. New, modern and easy to learn. Fast development with Code you control. Unbeatable cost-performance ratio :rocket:
repo_language: Go
owner: kataras
file_changes: filename: HISTORY.md
change_type: ModificationType.MODIFY
diff: @@ -28,6 +28,8 @@ The codebase for Dependency Injection, Internationalization and localization and
 
 ## Fixes and Improvements
 
+- Push a security fix reported by [Kirill Efimov](https://github.com/kirill89) for older go runtimes.
+
 - New `Configuration.Timeout` and `Configuration.TimeoutMessage` fields. Use it to set HTTP timeouts. Note that your http server's (`Application.ConfigureHost`) Read/Write timeouts should be a bit higher than the `Configuration.Timeout` in order to give some time to http timeout handler to kick in and be able to send the `Configuration.TimeoutMessage` properly.
 
 - New `apps.OnApplicationRegistered` method which listens on new Iris applications hosted under the same binary. Use it on your `init` functions to configure Iris applications by any spot in your project's files.

programming_language: Markdown
filename: context.go
change_type: ModificationType.MODIFY
diff: @@ -2032,13 +2032,7 @@ func (ctx *Context) FormFiles(key string, before ...func(*Context, *multipart.Fi
 
 		innerLoop:
 			for _, header := range fhs[key] {
-				// Fix an issue that net/http has,
-				// an attacker can push a filename
-				// which could lead to override existing system files
-				// by ../../$header.
-				// Reported by Frank through security reports.
-				header.Filename = strings.ReplaceAll(header.Filename, "../", "")
-				header.Filename = strings.ReplaceAll(header.Filename, "..\\", "")
+				header.Filename = filepath.Base(header.Filename)
 
 				for _, b := range before {
 					if !b(ctx, header) {
@@ -2100,13 +2094,9 @@ func (ctx *Context) UploadFormFiles(destDirectory string, before ...func(*Contex
 			for _, files := range fhs {
 			innerLoop:
 				for _, file := range files {
-					// Fix an issue that net/http has,
-					// an attacker can push a filename
-					// which could lead to override existing system files
-					// by ../../$file.
-					// Reported by Frank through security reports.
-					file.Filename = strings.ReplaceAll(file.Filename, "../", "")
-					file.Filename = strings.ReplaceAll(file.Filename, "..\\", "")
+					// Security fix for go < 1.17.5:
+					// Reported by Kirill Efimov (snyk.io) through security reports.
+					file.Filename = filepath.Base(file.Filename)
 
 					for _, b := range before {
 						if !b(ctx, file) {

programming_language: Go