CVE-2020-15101

Directory structure traversal issue in freewvs (before 0.1.1)

• CVSS 3.3
• CWE-674
• Resource Management
• Local

In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk(). This can be problematic in a case where an administrator scans the dirs of potentially untrusted users. This has been patched in 0.1.1.

CVE

CVE-2020-15101

CWE

CWE-674

CVSS base score

3.3

Published

2020-07-14

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Local

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update to freewvs version 0.1.1 or higher

import os

def walk(top):
    for dirpath, dirnames, filenames in os.walk(top):
        for filename in filenames:
            full_path = os.path.join(dirpath, filename)
            print(full_path)

walk('/path/to/scan')

import os

def walk(top):
    if not os.path.isabs(top):
        raise ValueError("Path must be absolute.")

    if not os.path.exists(top):
        raise ValueError("The specified path does not exist.")

    if not os.path.isdir(top):
        raise ValueError("The specified path is not a directory.")

    for dirpath, dirnames, filenames in os.walk(top):
        for filename in filenames:
            full_path = os.path.join(dirpath, filename)
            if os.path.commonpath([top, full_path]) != top:
                raise ValueError(f"Potential directory traversal detected: {full_path}")
            print(full_path)

walk('/path/to/scan')

@misc{vaitp:cve202015101,
  title        = {{Directory structure traversal issue in freewvs (before 0.1.1)}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2020-15101},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-15101/}}
}