René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Java]: CWE-073 - File path injection with the JFinal framework","articleBody":"### Query PR\n\nhttps://github.com/github/codeql/pull/7712\n\n### Language\n\nJava\n\n### CVE(s) ID list\n\n[CVE-2021-44093](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44093)\r\n+ A Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar function, could bypass the original limit, upload the JSP file to get a WebShell\r\n\r\n[CVE-2021-40639](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40639)\r\n+ Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties\u0026config=filemanager.config.js\n\n### CWE\n\nCWE-073: External Control of File Name or Path\n\n### Report\n\nExternal Control of File Name or Path, also called File Path Injection, is a common attack and injection attack is listed as one of the top attacks in OWASP Top Ten 2021.\r\n\r\nLoading files based on unvalidated user-input may cause file information disclosure and uploading files with unvalidated file types to an arbitrary directory may lead to Remote Command Execution (RCE).\r\n\r\n\u003ccode\u003e[JFinal](https://github.com/jfinal/jfinal)\u003c/code\u003e is a widely used Web + ORM framework, which has 1.4K forks and 3.2k stars on GitHub. More introduction can be found at \u003ccode\u003e[JFinal Tutorial](https://github.com/jfinal/jfinal-manual)\u003c/code\u003e. Multiple CWEs have been submitted for File Path Injection attack associated with this framework.\r\n\r\nThis query detects unsafe file loading/downloading operations in code repositories that consume this framework. It models \u003ccode\u003eJFinal\u003c/code\u003e input methods as remote flow source using the source model CSV format. It creates a separate \u003ccode\u003ePathSanitizer\u003c/code\u003e library so that the library can be promoted as a shared lib that can be used by other queries as well. It reduces FPs by pruning the sink and testing with both real projects on GitHub and test cases customized for this query. \r\n\n\n### Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).\n\n- [X] Yes\n- [ ] No\n\n### Blog post link\n\n_No response_","author":{"url":"https://github.com/luchua-bc","@type":"Person","name":"luchua-bc"},"datePublished":"2022-01-23T18:47:04.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":10},"url":"https://github.com/527/securitylab/issues/527"}