Full Report
JetBrains security advisory (AV26-1032)
Analysis Summary
# Vulnerability: Path Traversal in JetBrains Exposed Framework
## CVE Details
- **CVE ID:** CVE-2024-47879
- **CVSS Score:** 7.5 (High)
- **CWE:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal)
## Affected Systems
- **Products:** JetBrains Exposed (Kotlin SQL framework)
- **Versions:** All versions prior to 1.5.1
- **Configurations:** Systems utilizing the framework to process file paths or directory structures based on external input.
## Vulnerability Description
A path traversal vulnerability exists in the JetBrains Exposed framework. The flaw allows an attacker to bypass directory restrictions by manipulating input that the framework uses to construct file paths. This could potentially allow unauthorized access to files and directories stored outside of the intended web root or application directory.
## Exploitation
- **Status:** Not currently reported as exploited in the wild; PoC status is restricted.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Potential unauthorized reading of sensitive files)
- **Integrity:** None
- **Availability:** None
## Remediation
### Patches
- **JetBrains Exposed 1.5.1:** Users are urged to upgrade to version 1.5.1 or later immediately to resolve this vulnerability.
### Workarounds
- No official workarounds have been provided. The primary recommendation is a full version upgrade of the library.
## Detection
- **Indicators of Compromise:** Unusual file access patterns in application logs, specifically strings containing `../` or `..\` in parameters associated with database file operations.
- **Detection methods and tools:** Static Analysis Security Testing (SAST) tools can be used to scan project dependencies for the vulnerable version of the Exposed library.
## References
- **Vendor Advisory:** hxxps[://]www[.]jetbrains[.]com/privacy-security/issues-fixed/
- **Cyber Centre Bulletin:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/jetbrains-security-advisory-av26-1032
- **GitHub Security Advisory:** hxxps[://]github[.]com/JetBrains/Exposed/security/advisories/GHSA-m4m9-c52p-v565