Impact

io.whitesource.cure.FileSecurityUtils.isFileOutsideDir(String filePath, String baseDirPath) incorrectly treats sibling of a root directory (baseDirPath) as inside the root directory. As such, isFileOutsideDir is an insufficient guard against partial-path traversal attacks.

Vulnerability Root Cause

  public static boolean isFileOutsideDir(
          @NonNull final String filePath, @NonNull final String baseDirPath) throws IOException {
    File file = new File(filePath);
    File baseDir = new File(baseDirPath);
    return !file.getCanonicalPath().startsWith(baseDir.getCanonicalPath());
  }

- https://github.com/whitesource/CureKit/blob/d6ac3c382cb9d0b7a9f164eb3db1811d51f47c7c/src/main/java/io/whitesource/cure/FileSecurityUtils.java#L14-L26

The above bit of logic can be bypassed with the following payloads:

// The following will return 'false', although the attacker controlled value `/usr/foo/../foo-bar/bar` will be outside the `/usr/foo` directory
isFileOutsideDir("/usr/foo/../foo-bar/bar",  "/usr/foo")

True Root cause

If the result of parent.getCanonicalPath() is not slash terminated it allows for partial path traversal.

Consider "/usr/outnot".startsWith("/usr/out"). The check is bypassed although outnot is not under the out directory.
The terminating slash may be removed in various places. On Linux println(new File("/var/")) returns /var, but println(new File("/var", "/")) - /var/, however println(new File("/var", "/").getCanonicalPath()) - /var.
- @JarLob (Jaroslav Lobačevski)

References

Similar vulnerabilities:

• ESAPI (The OWASP Enterprise Security API) - https://nvd.nist.gov/vuln/detail/CVE-2022-23457