CVE-2021-3907
published 2021-11-11CVE-2021-3907: OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex…
PriorityP358critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
4.06%
89.6th percentile
OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cloudflare | octorpki | < 1.3.0 | 1.3.0 |
| cloudflare | octorpki | >= unspecified < 1.4.3 | 1.4.3 |
| debian | cfrpki | < cfrpki 1.4.0-1 (bookworm) | cfrpki 1.4.0-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | fort-validator | < cfrpki 1.4.0-1 (bookworm) | cfrpki 1.4.0-1 (bookworm) |
| github.com | cloudflare_cfrpki | >= 0 < 1.4.3 | 1.4.3 |
| github.com | cloudflare_cfrpki | >= 0 < 1.4.4 | 1.4.4 |
| nicmx | fort-validator | >= 0 < 1.5.3-1~deb11u1 | 1.5.3-1~deb11u1 |
| nicmx | fort-validator | >= 0 < 1.5.3-1 | 1.5.3-1 |
| nicmx | fort-validator | >= 0 < 1.5.3-1 | 1.5.3-1 |
| nicmx | fort-validator | >= 0 < 1.5.3-1 | 1.5.3-1 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa9.8CRITICAL
osv9.8CRITICAL
vendor_debian7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2021-3907: cfrpki - OctoRPKI does not escape a URI with a filename containing "..", this allows a re...
vendor_debian·2021·CVSS 7.4
CVE-2021-3907 [HIGH] CVE-2021-3907: cfrpki - OctoRPKI does not escape a URI with a filename containing "..", this allows a re...
OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.
Scope: local
bookworm: resolved (fixed in 1.4.0-1)
bullseye: resolved (fixed in 1.4.2-1~deb11u1)
OSV
Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki
osv·2022-07-15
CVE-2021-3907 Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki
Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki
Manifest path extraction is vulnerable to directory traversal attacks.
The ExtractPathManifest function permits file paths containing relative directory components (".."), permitting files to reference arbitrary locations on the filesystem.
OSV
Path traversal mitigation bypass in OctoRPKI
osv·2022-06-25·CVSS 9.8
CVE-2021-3907 [CRITICAL] Path traversal mitigation bypass in OctoRPKI
Path traversal mitigation bypass in OctoRPKI
### Impact
The existing URI path filters in OctoRPKI (version < 1.4.3) mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder.
### Specific Go Packages Affected
github.com/cloudflare/cfrpki/cmd/octorpki
### Patches
The issue was fixed in version 1.4.3
### References
[CVE-2021-3907](https://www.cvedetails.com/cve/CVE-2021-3907/)
GHSA
Path traversal mitigation bypass in OctoRPKI
ghsa·2022-06-25·CVSS 9.8
CVE-2021-3907 [CRITICAL] CWE-22 Path traversal mitigation bypass in OctoRPKI
Path traversal mitigation bypass in OctoRPKI
### Impact
The existing URI path filters in OctoRPKI (version < 1.4.3) mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder.
### Specific Go Packages Affected
github.com/cloudflare/cfrpki/cmd/octorpki
### Patches
The issue was fixed in version 1.4.3
### References
[CVE-2021-3907](https://www.cvedetails.com/cve/CVE-2021-3907/)
OSV
Path traversal in github.com/cloudflare/cfrpki/cmd/octorpki
osv·2022-02-14
CVE-2021-3907 [LOW] Path traversal in github.com/cloudflare/cfrpki/cmd/octorpki
Path traversal in github.com/cloudflare/cfrpki/cmd/octorpki
### Impact
In the case that a malicious TAL file is parsed pointing to a repository that provides a malicious ROA file which octorpki downloads, it is possible to bypass the current directory traversal mitigation to allow writing outside of the current directory.
### Patches
No patch release has been made
OSV
CVE-2021-3907: OctoRPKI does not escape a URI with a filename containing "
osv·2021-11-11·CVSS 9.8
CVE-2021-3907 [CRITICAL] CVE-2021-3907: OctoRPKI does not escape a URI with a filename containing "
OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.
GHSA
Arbitrary filepath traversal via URI injection
ghsa·2021-11-10
CVE-2021-3907 [HIGH] CWE-20 Arbitrary filepath traversal via URI injection
Arbitrary filepath traversal via URI injection
OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. `rsync://example.org/repo/../../etc/cron.daily/evil.roa`), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.
## Patches
## For more information
If you have any questions or comments about this advisory email us at [email protected]
OSV
Arbitrary filepath traversal via URI injection
osv·2021-11-10
CVE-2021-3907 [HIGH] Arbitrary filepath traversal via URI injection
Arbitrary filepath traversal via URI injection
OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. `rsync://example.org/repo/../../etc/cron.daily/evil.roa`), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.
## Patches
## For more information
If you have any questions or comments about this advisory email us at [email protected]
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/cloudflare/cfrpki/security/advisories/GHSA-3jhm-87m6-x959https://github.com/cloudflare/cfrpki/security/advisories/GHSA-cqh2-vc2f-q4fhhttps://www.debian.org/security/2021/dsa-5033https://www.debian.org/security/2022/dsa-5041https://github.com/cloudflare/cfrpki/security/advisories/GHSA-3jhm-87m6-x959https://github.com/cloudflare/cfrpki/security/advisories/GHSA-cqh2-vc2f-q4fhhttps://www.debian.org/security/2021/dsa-5033https://www.debian.org/security/2022/dsa-5041
2021-11-11
Published