7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-6q65-j4jw-9cg8

GHSA-6q65-j4jw-9cg8: DotVVM allows path traversal when deployed in Debug mode

Description

There is a path traversal vulnerability in any DotVVM application started in Debug mode, if at least one resource with the FileResourceLocation has been added. The vulnerability allows an attacker to read arbitrary files from the filesystem accessible by the web application (i.e. appsettings.json or other files containing secrets).

Patches

The bug is patched in versions 4.2.10, 4.3.8 and 5.0.0-preview03-final (and newer).

Apart from updating DotVVM, it is also recommend invalidating any secrets which could have been leaked by an application deployed in Debug mode (such as database passwords).

Workarounds

If you cannot update to a patched version, avoid running a publicly accessible DotVVM application in Debug mode (Development environment in Asp.Net Core). It is recommend adding the following statement to the DotvvmStartup class:

    config.Debug = false; // TODO: workaround for GHSA-6q65-j4jw-9cg8, remove after updating DotVVM

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-6q65-j4jw-9cg8

GHSA-6q65-j4jw-9cg8:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
DotVVM	nuget	>= 4.3.0-preview01-final, <= 4.3.7	4.3.8
DotVVM	nuget	>= 5.0.0-preview01-final, < 5.0.0-preview03-final	5.0.0-preview03-final
DotVVM	nuget	< 4.2.10	4.2.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal in DotVVM applications running in Debug mode when FileResourceLocation is used. The provided commit 68db0110beeda4e8e4be1b7c4e480ef876895bb5 patches this vulnerability by modifying the LocalResourceUrlManager.cs file.

The key change is within the TryLoadAlternativeFile method. Before the patch, this method took a name parameter (derived from the request URL) and used it to locate alternative files (e.g., source maps) without properly validating it for path traversal characters. This allowed an attacker to craft a URL that could access arbitrary files on the server, as the name parameter could contain sequences like ../.

The patch introduces a new helper method IsAllowedFileName which explicitly checks for path traversal characters (/, \\), leading dots, and invalid file name characters. The TryLoadAlternativeFile method now calls IsAllowedFileName at the beginning, and if the validation fails, it returns null, preventing the path traversal.

Therefore, DotVVM.Framework.ResourceManagement.LocalResourceUrlManager.TryLoadAlternativeFile is the vulnerable function because it processed potentially malicious input (name) and used it in file system operations without sufficient prior sanitization, leading to the path traversal vulnerability. The vulnerability is triggered when an attacker requests a resource, and the application, in Debug mode, attempts to find an alternative file (like a .map file) using this unsanitized name.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.