Traversée de chemin dans l'expansion de fichier javadoc de Reposilite (création/écrasement arbitraire de fichier) (`GHSL-2024-073`)

The primary impact of CVE-2024-36116 is the ability for an attacker to upload arbitrary files to the Reposilite server. This is achieved by manipulating the expansion of Javadoc archives, exploiting a flaw in how the JavadocEndpoints.kt controller handles file paths. Successful exploitation could allow an attacker to upload malicious code, such as a web shell, granting them remote code execution (RCE) capabilities. This could lead to complete control of the server, data exfiltration, and further lateral movement within the network. The blast radius extends to any sensitive data stored or processed by Reposilite, including repository metadata and potentially associated code.

Organizations utilizing Reposilite Backend for managing software repositories are at risk, particularly those running version 3.5.10. Environments where Reposilite is exposed to untrusted networks or where JavaDoc archives are sourced from external, unverified sources are at higher risk. Shared hosting environments using Reposilite are also vulnerable, as a compromised account could potentially exploit this vulnerability.

• linux / server:

journalctl -u reposilite -g "JavadocEndpoints.kt"

• generic web:

curl -I http://your-reposilite-server/javadocs/path/to/malicious/file.php

• generic web:

grep -r 'JavadocEndpoints.kt' /var/log/apache2/access.log

1. 2024-08-02Disclosure

   disclosure

1. Réservé2024-05-20
2. Publiée2024-08-02
3. Modifiée2024-11-04
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2024-36116 is to upgrade Reposilite Backend to version 3.5.12 or later, which contains the fix for this vulnerability. If an immediate upgrade is not possible, consider implementing temporary workarounds. Restrict file upload permissions and implement strict input validation on all file paths to prevent path traversal attempts. Web Application Firewalls (WAFs) can be configured to block requests containing suspicious file paths or extensions. Monitor Reposilite logs for unusual file upload activity and unauthorized access attempts. After upgrading, verify the fix by attempting to upload a file with a manipulated path and confirming that the upload is rejected.