[GHSA-rhcg-rwhx-qj3j] Improper Limitation of a Pathname to a Restricted Directory in Spring Framework

[sunSUNQ]

Updates

• References
• Source code location

Comments
Add source code location and patch links related to CVE-2014-3578.

[JonathanLEvans]

Hi @sunSUNQ, can you explain how these commits relate to the advisory?

[sunSUNQ]

Hello, I found that spring-projects/spring-framework#16414 is related to CVE-2014-3578. It mentions [SPR-11793]Currently cleanPath stops at the first semicolon assuming a protocol prefixed path (e.g. "file:core/../core/io/Resource.class"). This is a bit too simple since technically a semicolon is also allowed in a directory name, even if unusual. The current vulnerability is related to the mishandling of the cleanPath class, and it is addressed in spring-projects/spring-framework@f6fddeb, which mentions the fix for SPR-11793. Therefore, I believe this patch is related to the fix for CVE-2014-3578, while the other two patches are fixes on different branches.

[advisory-database]

Hi @sunSUNQ! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!