Traversée de chemin dans Eclipse Vert.x

The core of this vulnerability lies in how Vert.x Web handles backslashes in file paths on Windows systems. The StaticHandler component fails to properly sanitize these backslashes, allowing an attacker to construct a path that escapes the intended webroot directory. This escape can lead to the exposure of sensitive files, including configuration files, source code, or even system files, depending on the server's permissions and file system structure. Successful exploitation could result in complete compromise of the server and data exfiltration. While the vulnerability description focuses on Windows, the underlying logic flaw could potentially be exploited on other operating systems with appropriate path manipulation techniques.

Organizations deploying Vert.x Web applications, particularly those running on Windows servers or with legacy configurations that haven't been updated to version 3.9.4, are at significant risk. Shared hosting environments utilizing Vert.x Web are also vulnerable, as they may not have control over the underlying Vert.x Web version.

• java / server:

find /opt/vertx/lib -name "*vertx-web-*.jar" -print0 | xargs -0 grep -iE 'StaticHandler.*backslashes'

• java / supply-chain: Check dependencies in your project's build file (pom.xml or build.gradle) for Vert.x Web versions prior to 3.9.4. • generic web: Review access logs for requests containing unusual or excessive backslashes in the file path, especially those targeting static resources.

1. 2019-06-18Discovery

   discovery

2. 2022-02-10Disclosure

   disclosure

3. 2022-02-10PoC

   poc

4. 2022-02-10Patch

   patch

1. Réservé2019-10-16
2. Publiée2022-02-10
3. Modifiée2023-11-08
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2019-17640 is to upgrade to Eclipse Vert.x Web version 3.9.4 or later. This version includes a fix that properly handles backslashes in file paths, preventing the path traversal. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing suspicious path patterns, particularly those with excessive or unusual backslashes. Additionally, review and restrict file system permissions to minimize the potential impact of a successful attack. Ensure the webroot directory is properly configured and secured.