CVE-2018-17605 (published 2018-09-28T09:29Z)

An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in AssetPipelineFilter.groovy or AssetPipelineFilterCore.groovy.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/bertramdev/asset-pipeline
commit_details: repo_url: https://github.com/bertramdev/asset-pipeline
author: David Estes
author_date: 2018-08-22 13:23:55-04:00
msg: fixing jetty classloader vulnerability with potential reverse file traverse route when running servlet based apps in jetty
repository: repo_url: https://github.com/bertramdev/asset-pipeline
repo_name: bertramdev/asset-pipeline
description: The core implementation of the asset pipeline for the jvm
repo_language: JavaScript
owner: bertramdev
file_changes: filename: AssetPipelineFilter.groovy
change_type: ModificationType.MODIFY
diff: @@ -4,6 +4,7 @@ package asset.pipeline
 import asset.pipeline.grails.AssetAttributes
 import asset.pipeline.grails.AssetProcessorService
 import asset.pipeline.grails.ProductionAssetCache
+import asset.pipeline.AssetHelper
 import groovy.transform.CompileStatic
 import groovy.util.logging.Commons
 import javax.servlet.FilterChain
@@ -63,7 +64,7 @@ class AssetPipelineFilter extends OncePerRequestFilter {
 			if(fileUri.startsWith('/')) {
 				manifestPath = fileUri.substring(1) //Omit forward slash
 			}
-
+			fileUri = AssetHelper.normalizePath(fileUri) //JETTY Security bug, we MUST prevent reverse traversal
 			fileUri = manifest?.getProperty(manifestPath, manifestPath)
 
 

programming_language: Scala
filename: AssetPipelineFilterCore.groovy
change_type: ModificationType.MODIFY
diff: @@ -3,6 +3,7 @@ package asset.pipeline.servlet
 
 import asset.pipeline.AssetPipelineResponseBuilder
 import asset.pipeline.AssetPipelineConfigHolder
+import asset.pipeline.AssetHelper
 import java.util.logging.Logger
 import javax.servlet.FilterChain
 import javax.servlet.ServletContext
@@ -43,6 +44,7 @@ class AssetPipelineFilterCore {
 		if(fileUri.startsWith(baseAssetUrl)) {
 			fileUri = fileUri.substring(baseAssetUrl.length())
 		}
+		fileUri = AssetHelper.normalizePath(fileUri) //JETTY Security bug, we MUST prevent reverse 
 		final Properties manifest = AssetPipelineConfigHolder.manifest
 		String manifestPath = fileUri
 		if(fileUri.startsWith('/')) {

programming_language: Scala
filename: build.gradle
change_type: ModificationType.MODIFY
diff: @@ -8,7 +8,7 @@ buildscript {
 }
 
 subprojects {
-	version = '3.0.3'
+	version = '3.0.4'
 }
 
 apply plugin: 'groovy'

programming_language: JavaScript