CVE-2020-15230
Arbitrary file read un Vapor
In short
Vapor web framework versions before 4.29.4 have a flaw in FileMiddleware that allows attackers to read any file on the server by manipulating file paths. This is dangerous because attackers can access sensitive data like configuration files or private keys.
Technical detail
Path traversal vulnerability in Vapor's FileMiddleware (CWE-22) allows unauthenticated attackers to bypass directory restrictions and read arbitrary files on the filesystem. The vulnerability requires only that FileMiddleware is enabled; exploitation occurs through crafted requests with path traversal sequences that are not properly sanitized before file access.
Summary generated and translated by AI from the official description.
Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Affected products
vapor · vaporWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →