CVE-2022-31255

Path Traversal vulnerability in SUSE Manager Server 4.2 and 4.3

• CVSS 4.3
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Remote

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to read files available to the user running the process, typically tomcat. This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10.

CVE

CVE-2022-31255

CWE

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

4.3

Published

2022-11-10

OWASP

A01 Broken Access Control

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update spacewalk-java to version 4.3.39 or higher.

import os

def read_file(user_input):
    """Vulnerable function that demonstrates the security issue."""
    base_directory = '/var/lib/susemanager/files'
    
    full_path = os.path.join(base_directory, user_input)
    
    with open(full_path, 'r') as file:
        return file.read()

user_input = '../etc/passwd'
try:
    content = read_file(user_input)
    print(content)
except Exception as e:
    print(e)

import os

def read_file(user_input):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents path traversal
    base_directory = '/var/lib/susemanager/files'
    normalized_path = os.path.normpath(user_input)
    
    if not normalized_path.startswith(base_directory):
        raise ValueError("Access to the requested file is denied.")
    
    full_path = os.path.join(base_directory, normalized_path)
    
    with open(full_path, 'r') as file:
        return file.read()

user_input = '../etc/passwd'
try:
    content = read_file(user_input)
    print(content)
except Exception as e:
    print(e)

@misc{vaitp:cve202231255,
  title        = {{Path Traversal vulnerability in SUSE Manager Server 4.2 and 4.3}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-31255},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-31255/}}
}