Junglewise Threat Intelligence

CVE-2016-5725: JCraft JSch directory traversal in ChannelSftp on Windows

CVE-2016-5725 · Severity: medium · CVSS 5.9 · Published 2017-01-19

Technologies: Microsoft Windows. Vendors: Microsoft, Maven.

Executive brief

JSch is a Java library used by many popular applications (like Eclipse, Ant, and NetBeans) to handle secure file transfers and remote connections. A vulnerability in the way it handles file downloads on Windows systems could allow a malicious server to trick the library into writing files to unintended locations on the user's computer. This could result in an attacker overwriting sensitive system files or planting malicious scripts if a user connects to a compromised or rogue SFTP server.

Technical details

A directory traversal vulnerability exists in the JCraft JSch Java library when running on Windows. The flaw is located in the ChannelSftp implementation during recursive 'GET' operations when the mode is set to ChannelSftp.OVERWRITE. A malicious SFTP server can respond to a recursive download request with filenames containing '..\' (dot dot backslash) sequences. Because the library fails to properly sanitize these Windows-specific path separators, it can be coerced into writing files outside of the intended destination directory. This allows a remote attacker to overwrite arbitrary files with the permissions of the Java process. The vulnerability was patched in version 0.1.54.

Affected products

  • JCraft JSch before 0.1.54

Timeline

  • 2016-08-31: other: Vulnerability details and PoC authored by tintinweb
  • 2016-09-21: disclosed: Public disclosure on Full Disclosure mailing list
  • 2016-09-21: patched: JSch version 0.1.54 released with fix
  • 2017-01-19: advisory: NVD published CVE-2016-5725

References

Related threats