CVE-2022-4065: cbeust testng XML File Parser JarFileUtils.java testngXmlExistsInJar path traversal
Impact
Affected by this vulnerability is the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML File Parser.
The manipulation leads to path traversal only for .xml, .yaml and .yml files by default. The attack implies running an unsafe test JAR. However since that JAR can also contain executable code itself, the path traversal is unlikely to be the main attack.
Patches
A patch is available in version 7.7.0 at commit 9150736cd2c123a6a3b60e6193630859f9f0422b. It is recommended to apply a patch to fix this issue. The patch was pushed into the master branch but no releases have yet been made with the patch included.
A backport of the fix is available in version 7.5.1 for Java 8 projects.
Workaround
Specify which tests to run when invoking TestNG by configuring them on the CLI or in the build tool controlling the run. Do not run tests with untrusted JARs on the classpath, this includes pull requests on open source projects.
Other sources
A vulnerability was found in cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0. It has been declared as critical. Affected by this vulnerability is the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML File Parser. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 7.5.1 and 7.7.1 is able to address this issue. The patch is named 9150736cd2c123a6a3b60e6193630859f9f0422b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-214027.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.testng:testngto a version that resolves this vulnerability.Fixed in 7.7.0 - Upgrade
Upgrade
maven/org.testng:testngto a version that resolves this vulnerability.Fixed in 7.5.1 - Upgrade
Upgrade
cbeust/testng (XML File Parser)to a version that resolves this vulnerability.Fixed in 7.5.1 - Upgrade
Upgrade
cbeust/testng (XML File Parser)to a version that resolves this vulnerability.Fixed in 7.7.1 - Upgrade
Upgrade
cbeust/testng (XML File Parser)to a version that resolves this vulnerability.Patch 9150736cd2c123a6a3b60e6193630859f9f0422b - Configuration
Specify which tests to run when invoking TestNG by configuring them on the CLI or in the build tool controlling the run.
TestNG Which tests to run (CLI/build tool configuration) = configured tests (explicit list) - Compensating control
Do not run TestNG tests with untrusted JARs on the classpath (this includes pull requests on open source projects).
Event History
Frequently Asked Questions
What is the severity of CVE-2022-4065?
CVE-2022-4065 has been categorized with a medium severity due to its potential for path traversal attacks affecting XML file processing.
How do I fix CVE-2022-4065?
To fix CVE-2022-4065, update to TestNG version 7.7.0 or later.
What type of files are impacted by CVE-2022-4065?
CVE-2022-4065 specifically affects XML, YAML, and YML files during processing.
What is the impact of the vulnerability CVE-2022-4065?
The impact of CVE-2022-4065 allows attackers to exploit path traversal vulnerabilities in affected TestNG versions.
Which versions of TestNG are affected by CVE-2022-4065?
CVE-2022-4065 affects TestNG versions between 6.13 and 7.5.1, and includes 7.6.0 through 7.7.0.