Date: Sat, 16 Aug 2014 02:12:41 -0400 (EDT) From: cve-assign@...re.org To: carnil@...ian.org Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE Request: Plack::App::File does not prune trailing slashes: possible code exposure / information disclosure -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > - Plack::App::File would previously strip trailing slashes off > provided paths. This in combination with the common pattern > of serving files with Plack::Middleware::Static could allow > an attacker to bypass a whitelist of generated files > > http://api.metacpan.org/source/MIYAGAWA/Plack-1.0031/Changes > https://github.com/plack/Plack/issues/405 The underlying issue is that Plack::App::File allowed a trailing slash in a pathname referring to a plain file. There is at least one specification suggesting that this is wrong: http://pubs.opengroup.org/onlinepubs/9699919799/xrat/V4_xbd_chap04.html#tag_21_04_12 Pathnames that end with one or more trailing <slash> characters must refer to directory paths. Earlier versions of this standard were not specific about the distinction between trailing <slash> characters on files and directories, and both were permitted. Without going into the question of whether Plack is responsible for following that specification, it seems that the vendor identified arguably wrong behavior that had a security impact, and fixed it. Use CVE-2014-5269. (In some related but non-identical situations -- for example, if a product decided to reject a valid pathname such as /etc//// as a possibly misguided attempt at security hardening -- there wouldn't be a CVE ID.) - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJT7vXRAAoJEKllVAevmvmsybAIAISVSn6yyAhD842i4/pVgJ5t 86heLybkqoFgCYlmWXDacwX6stqK8/ndhD1+mhUCMXNs1iqsPJ43xBT+RF1gOVOw 5AoYOIiqyWF0rLYdkgAaOYxNxDIHhb+iZswEyLi3RNKAAZESunDO5RzIhxn492d/ NoCZEzT/FWLju0skoV8+YTN5UrAxPZspVD7tRJ99tFQTsmDj72qMRUqfrey59W0e O4jtU+7laffKTPFVlHzO7X2BuAm9739mObaicvgH3CjCdOV3Zg9jp2zzpvfdMxfH SDzwJctY+Q4mlIGK0vv2h3ouKUKQudeVGevQzh8Epa7G/Jrp6bq7f8mVaTRLyCo= =e2Sd -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ