Reposilite anfällig für Path Traversal beim Ausliefern erweiterter Javadoc-Dateien (arbitrary file read) (`GHSL-2024-074`)

The vulnerability lies in the handling of expanded javadoc files within the /javadoc/{repository}/<gav>/raw/<resource> endpoint. An attacker can craft a malicious <resource> path containing path traversal sequences (e.g., ../..) to navigate outside the intended javadocUnpackPath directory. This allows them to read files they shouldn't have access to, such as configuration files, source code, or other sensitive data stored on the server. The potential impact includes data breaches, compromise of credentials, and potential for further exploitation if sensitive files contain valuable information. This vulnerability shares similarities with other path traversal exploits where attackers leverage predictable file paths to gain unauthorized access.

Organizations using Reposilite Backend for artifact repository management, particularly those with publicly accessible javadoc endpoints or those who have not implemented strict access controls, are at risk. Shared hosting environments where multiple users share the same Reposilite instance are also particularly vulnerable.

• linux / server:

find /opt/reposilite/javadocUnpackPath -type f -name '*.*' -print0 | xargs -0 grep -i 'sensitive_data'

• generic web:

curl -I 'http://your-reposilite-instance/javadoc/your-repo/your-gav/raw/../../../../etc/passwd' 

• java: Monitor Reposilite logs for unusual file access patterns or errors related to file reading from unexpected locations.

1. 2024-11-04Disclosure

   disclosure

1. Reserviert2024-05-20
2. Veröffentlicht2024-11-04
3. Geändert2024-11-05
4. EPSS aktualisiert2026-04-02

The primary mitigation is to upgrade Reposilite Backend to version 3.5.12 or later, which includes the fix for this vulnerability. If upgrading immediately is not possible, consider implementing temporary workarounds. One approach is to restrict access to the /javadoc endpoint to trusted users or networks. Another is to implement input validation on the <resource> parameter to prevent path traversal sequences. Additionally, consider using a Web Application Firewall (WAF) to filter requests containing suspicious path characters. After upgrading, verify the fix by attempting to access a file outside the intended javadocUnpackPath directory via the /javadoc endpoint; the request should be denied.