StaticFile.fromUrl can leak presence of a directory
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.21.24, 1.0.0-M23, 0.22.0-RC1, 0.23.0-RC1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Http4s is a Scala interface for HTTP services. `StaticFile.fromUrl` can leak the presence of a directory on a server when the `URL` scheme is not `file://`, and the URL points to a fetchable resource under its scheme and authority. The function returns `F[None]`, indicating no resource, if `url.getFile` is a directory, without first checking the scheme or authority of the URL. If a URL connection to the scheme and URL would return a stream, and the path in the URL exists as a directory on the server, the presence of the directory on the server could be inferred from the 404 response. The contents and other metadata about the directory are not exposed. This affects http4s versions: 0.21.7 through 0.21.23, 0.22.0-M1 through 0.22.0-M8, 0.23.0-M1, and 1.0.0-M1 through 1.0.0-M22. The patch is available in the following versions: v0.21.24, v0.22.0-M9, v0.23.0-M2, v1.0.0-M23. As a workaround users can avoid calling `StaticFile.fromUrl` with non-file URLs.
Timeline
- CVE published
- Record last updated
Affected versions
- http4s http4s
From 0.21.7 · fixed in 0.21.24; From 0.22.0-M1 · through 0.22.0-M8; From 1.0.0-M1 · fixed in 1.0.0-M23
- org.http4s:http4s-coreMaven
From 0.21.7 · fixed in 0.21.24
- org.http4s:http4s-coreMaven
From 0.22.0-M1 · fixed in 0.22.0-RC1
- org.http4s:http4s-coreMaven
From 0.23.0-M1 · fixed in 0.23.0-RC1
- org.http4s:http4s-coreMaven
From 1.0.0-M1 · fixed in 1.0.0-M23