Miggo Logo
Miggo Vulnerability Database
→
GHSA-6xv5-86q9-7xr8

GHSA-6xv5-86q9-7xr8: SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced

N/A

CVSS Score

Basic Information

CVE ID
-
GHSA ID
GHSA-6xv5-86q9-7xr8
EPSS Score
-
CWE
-
Published
9/7/2023
Updated
9/7/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/cyphar/filepath-securejoingo< 0.2.40.2.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper handling of Windows volume names in path joining logic. The original implementation in SecureJoinVFS did not strip volume names from 'unsafePath' (via filepath.VolumeName), enabling scenarios where a malicious path like 'D:\malicious' combined with a rootfs 'C:\safe' could resolve outside the rootfs. The patch explicitly adds volume name stripping, confirming this was the vulnerable code path.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *or Win*ows us*rs o* `*it*u*.*om/*yp**r/*il*p*t*-s**ur*join`, until v*.*.* it w*s possi*l* *or **rt*in root*s *n* p*t* *om*in*tions (in p*rti*ul*r, w**r* * m*li*ious Unix-styl* `/`-s*p*r*t** uns*** p*t* w*s us** wit* * Win*ows-styl* root*s

Reasoning

T** vuln*r**ility st*ms *rom improp*r **n*lin* o* Win*ows volum* n*m*s in p*t* joinin* lo*i*. T** ori*in*l impl*m*nt*tion in `S**ur*JoinV*S` *i* not strip volum* n*m*s *rom 'uns***P*t*' (vi* `*il*p*t*.Volum*N*m*`), *n**lin* s**n*rios w**r* * m*li*iou