CVE-2022-23457: GHSL-2022-008: Path traversal in the OWASP Enterprise Security API (ESAPI)- CVE-2022-23457
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of Validator.getValidDirectoryPath(String, String, File, boolean) may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this.
Other sources
getValidDirectoryPath incorrectly treats sibling of a root directory as a child.
— GitHub Security Lab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libowasp-esapi-javato a version that resolves this vulnerability.Fixed in 2.4.0.0-2Fixed in 2.4.0.0-2.1Fixed in 2.4.0.0-3 - Upgrade
Upgrade
debian/libowasp-esapi-javato a version that resolves this vulnerability.Fixed in 2.4.0.0-1 - Upgrade
Upgrade
OWASP ESAPIto a version that resolves this vulnerability.Fixed in 2.3.0.0
Event History
Frequently Asked Questions
What is CVE-2022-23457?
CVE-2022-23457 is a vulnerability in the ESAPI (The OWASP Enterprise Security API) library that allows an attacker to manipulate directory paths in an insecure manner.
What is the severity level of CVE-2022-23457?
The severity level of CVE-2022-23457 is critical with a CVSS score of 9.8.
Which software is affected by CVE-2022-23457?
CVE-2022-23457 affects the following software: OWASP Enterprise Security API (up to version 2.3.0.0), Oracle WebLogic Server (version 12.2.1.3.0 and 12.2.1.4.0), Oracle WebLogic Server (version 14.1.1.0.0), Netapp Active Iq Unified Manager, Apple iPadOS, Apple watchOS, and NetApp OnCommand Workflow Automation.
How can an attacker exploit CVE-2022-23457?
An attacker can exploit CVE-2022-23457 by supplying a malicious input string that can be incorrectly treated as a child directory of a specified path, leading to potential directory traversal attacks.
Are there any patches or fixes available for CVE-2022-23457?
Yes, patches and fixes are available for CVE-2022-23457. It is recommended to update to a version of the affected software that includes the fix or apply the necessary security patches provided by the vendor.