CVE-2016-5725: Path Traversal
Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.
Other sources
JSch could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to the implementation for recursive sftp-get containing "dot dot" sequences (/../) to download the malicious files outside the client download base directory.
— IBM
The following flaw was found in jsch:
A malicious sftp server may force a client-side relative path traversal in jsch's implementation for recursive sftp-get allowing the server to write files outside the clients download basedir with effective permissions of the jsch sftp client process.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5725?
CVE-2016-5725 is considered a medium severity vulnerability as it allows directory traversal leading to unauthorized file access.
How do I fix CVE-2016-5725?
To fix CVE-2016-5725, update JSch to a version later than 0.1.53 where the vulnerability has been addressed.
What types of attacks can CVE-2016-5725 be used for?
CVE-2016-5725 can be exploited by attackers to download sensitive files from outside the intended directory using crafted SFTP requests.
Which versions of JSch are affected by CVE-2016-5725?
All versions of JSch up to and including 0.1.53 are affected by CVE-2016-5725.
Is CVE-2016-5725 specific to any operating system?
No, CVE-2016-5725 affects the JCraft JSch library and is not limited to any specific operating system.