by Kastro
Paper/Archive/CVE-2021-3907

CVE-2021-3907

Cloudflare octorpki — Arbitrary filepath traversal via URI injection

EPSS 4%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 91.0.910 × 2018.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.

Affected

ProductAffectedFixed inSource
octorpkiunspecified – < 1.4.31.4.3CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cloudflare (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

References

refgithub.com/cloudflare/cfrpki/security/advisories/GHSA-cqh2-vc2f-q4fhadvisorydebian.org/security/2021/dsa-5033advisorydebian.org/security/2022/dsa-5041refgithub.com/cloudflare/cfrpki/security/advisories/GHSA-3jhm-87m6-x959