Possible path traversal when storing RRDP responses
CVE-2023-39916

9.3CRITICAL

Key Information:

Vendor

Nlnet Labs

Status
Routinator
Vendor
CVE Published:
13 September 2023

What is CVE-2023-39916?

NLnet Labs' Routinator versions 0.9.0 through 0.12.1 expose a vulnerability that could allow an attacker to perform path traversal through the keep-rrdp-responses feature. This happens because the storage location for responses to RRDP requests is derived from the request URL without adequate sanitization. Consequently, malicious actors could leverage this flaw to store response content outside the intended directory, potentially leading to unauthorized data access.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Routinator 0.9.0 < 0.12.2

Routinator 0.14.*

References

https://nlnetlabs.nl/downloads/routinator/CVE-2023-39916.txt
vendor-advisory

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Haya Shulman
Donika Mirdita
Niklas Vogel
JSON
.