GHSA-7952-gx68-cjqr: Path Traversal
Impact When reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system.
Patches This issue is addressed in MPXJ version 16.5.0.
Workarounds Do not read PRX or STX files from untrusted sources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/net.sf.mpxj:mpxjto a version that resolves this vulnerability.Fixed in 16.5.0 - Upgrade
Upgrade
nuget/net.sf.mpxj-for-vbto a version that resolves this vulnerability.Fixed in 16.5.0 - Upgrade
Upgrade
nuget/net.sf.mpxj-for-csharpto a version that resolves this vulnerability.Fixed in 16.5.0 - Upgrade
Upgrade
nuget/net.sf.mpxjto a version that resolves this vulnerability.Fixed in 16.5.0 - Upgrade
Upgrade
pip/mpxjto a version that resolves this vulnerability.Fixed in 16.5.0 - Upgrade
Upgrade
rubygems/mpxjto a version that resolves this vulnerability.Fixed in 16.5.0 - Upgrade
Upgrade
nuget/MPXJ.Netto a version that resolves this vulnerability.Fixed in 16.5.0 - Upgrade
Upgrade
MPXJto a version that resolves this vulnerability.Fixed in 16.5.0 - Compensating control
Do not read PRX or STX files from untrusted sources.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using MPXJ that read PRX or STX files are exposed if they may process attacker-controlled files. The affected package listings include Maven, NuGet, PyPI, and RubyGems distributions of MPXJ.
What does an attacker need to exploit the vulnerability?
An attacker needs to cause the application to read a suitably crafted PRX or STX file. No authentication or user interaction is indicated by the supplied vector.
What can be done if upgrading is not immediately possible?
Do not read PRX or STX files from untrusted sources. Restrict ingestion to files from trusted, controlled origins until MPXJ can be updated.
What version contains the fix?
The issue is addressed in MPXJ version 16.5.0.