CVE-2022-30636: Limited directory traversal vulnerability on Windows in golang.org/x/crypto
Golang autocert package could allow a remote attacker to traverse directories on the system, caused by a flaw in the the DirCache implementation. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Other sources
httpTokenCacheKey uses path.Base to extract the expected HTTP-01 token value to lookup in the DirCache implementation. On Windows, path.Base acts differently to filepath.Base, since Windows uses a different path separator (\ vs. /), allowing a user to provide a relative path, i.e. .well-known/acme-challenge/..\..\asd becomes ..\..\asd. The extracted path is then suffixed with +http-01, joined with the cache directory, and opened. Since the controlled path is suffixed with +http-01 before opening, the impact of this is significantly limited, since it only allows reading arbitrary files on the system if and only if they have this suffix.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-30636?
CVE-2022-30636 has been rated as a medium severity vulnerability.
How do I fix CVE-2022-30636?
To fix CVE-2022-30636, update to the latest version of golang.org/x/crypto that addresses this vulnerability.
What systems are affected by CVE-2022-30636?
CVE-2022-30636 primarily affects applications using golang.org/x/crypto on Windows systems.
What type of vulnerability is CVE-2022-30636?
CVE-2022-30636 is a path traversal vulnerability that allows for relative path input leading to unauthorized access.
Can CVE-2022-30636 be exploited remotely?
Yes, CVE-2022-30636 can be exploited remotely if an attacker can manipulate HTTP requests.