Travessia de caminho em Goobi viewer Core

The path traversal vulnerability in Goobi Viewer Core allows an attacker to manipulate file paths within the application, bypassing intended access controls. By crafting malicious requests, an attacker can potentially read files located outside of the intended web root directory. The scope of access is limited to files accessible by the application server user (e.g., Tomcat), but this could still include configuration files, database credentials, or other sensitive information. While not directly leading to remote code execution, the disclosure of such data could be leveraged for further attacks, such as privilege escalation or data breaches.

Organizations utilizing Goobi Viewer Core in production environments, particularly those with sensitive data stored on the server, are at risk. Shared hosting environments where multiple users share the same server instance are also particularly vulnerable, as a compromised Goobi Viewer Core instance could potentially expose data belonging to other users.

• java / server:

find /var/lib/tomcat/webapps/goobi-viewer-core/ -name "*.properties"

• generic web:

curl -I 'http://your-goobi-viewer-core-url/../../../../etc/passwd' # Check for file disclosure

1. 2020-07-22Disclosure

   disclosure

1. Reservado2020-06-25
2. Publicada2020-07-22
3. Modificada2024-08-04
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2020-15124 is to immediately upgrade Goobi Viewer Core to version 4.8.3 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting file access permissions for the application server user to the absolute minimum required. Additionally, configure a Web Application Firewall (WAF) to filter requests containing suspicious path traversal patterns (e.g., '../'). Regularly review application logs for any unusual file access attempts. After upgrading, confirm the fix by attempting a path traversal attack and verifying that access is denied.