Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-24042

CVE-2024-24042: Path traversal in flaskcode Devan-Kerman ARRP

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-24042
GHSA ID
GHSA-cg24-jjr5-rxmf
EPSS Score
0.84376%
CWE
CWE-22
Published
3/19/2024
Updated
3/29/2024
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
net.devtech:arrpmaven<= 0.8.10.8.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper path normalization in two methods handling file operations. The original code used Path.startsWith() without resolving absolute paths, making it vulnerable to directory traversal via relative paths (e.g., '../../malicious.file'). The patch explicitly uses toAbsolutePath() in both methods to ensure proper containment checks. These functions are directly referenced in the CVE description and commit diff, with the vulnerability manifesting when attacker-controlled data flows through them during dump operations.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*ir**tory Tr*v*rs*l vuln*r**ility in **v*n-K*rm*n *RRP v.*.*.* *n* ***or* *llows * r*mot* *tt**k*r to *x**ut* *r*itr*ry *o** vi* t** *ump*ir**t in Runtim*R*sour**P**kImpl *ompon*nt.

Reasoning

T** vuln*r**ility st*ms *rom improp*r p*t* norm*liz*tion in two m*t*o*s **n*lin* *il* op*r*tions. T** ori*in*l *o** us** `P*t*.st*rtsWit*()` wit*out r*solvin* **solut* p*t*s, m*kin* it vuln*r**l* to *ir**tory tr*v*rs*l vi* r*l*tiv* p*t*s (*.*., '../.