ICEfaces
  1. ICEfaces
  2. ICE-8772

SECURITY: External Control of File Name or Path

    Details

    • Type: Improvement Improvement
    • Status: Closed
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: 3.2
    • Fix Version/s: EE-3.2.0.GA, 3.3
    • Component/s: Framework, ICE-Components
    • Labels:
      None
    • Environment:
      Security
    • Assignee Priority:
      P2

      Description

      This is a specific case opened up as part of a detailed analysis (ICE-8771) of a Veracode security report submitted by a customer.

      The reported issue was: "External Control of File Name or Path"

      The details provided by Veracode were:

      This call to java.lang.ClassLoader.getResourceAsStream() contains a path manipulation flaw. The argument to the function is a filename constructed using user-supplied input. If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to files on the server, including those outside the webroot, that would be normally be inaccessible to end users. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to getResourceAsStream() contains tainted data from the variable path. The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getPathInfo. Validate all user-supplied input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using black lists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters.

      The relevant class is:

      com.icesoft.faces.webapp.CompatResourceServlet
           void service(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)

      The task is to review the and attempt to ensure, if possible, that input from the user is sanitized before being used to generate path names.

        Issue Links

          Activity

            People

            • Assignee:
              Deryk Sinotte
              Reporter:
              Deryk Sinotte
            • Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: