CVE-2014-7816: Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow
5
CVSS Score
Basic Information
CVE ID
GHSA ID
EPSS Score
0.97873%
CWE
Published
5/17/2022
Updated
1/27/2023
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
AV:N/AC:L/Au:N/C:P/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.undertow:undertow-core | maven | >= 1.0.0, < 1.0.17 | 1.0.17 |
| io.undertow:undertow-core | maven | >= 1.1.0.Beta1, <= 1.1.0.CR4 | 1.1.0.CR5 |
| io.undertow:undertow-core | maven | >= 1.2.0.Beta1, <= 1.2.0.Beta2 | 1.2.0.Beta3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper path handling on Windows systems. The patches add explicit checks for system path separators in three critical locations:
- ResourceHandler's serveResource - Directly processes resource requests
- DefaultServlet's doGet - Handles static resource serving
- ServletPathMatches' findWelcomeFile - Processes welcome file resolution
In unpatched versions, these functions would process paths containing Windows-style backslashes without proper normalization, allowing attackers to bypass directory traversal protections using alternate path separators. The vulnerable functions are directly involved in processing user-supplied URIs and resource resolution, making them key runtime detection points.