path traversal in Jooby
Impact
Access to sensitive information available from classpath.
Patches
Patched version: 1.6.7 and 2.8.2
Commit 1.x: https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009
Commit 2.x: https://github.com/jooby-project/jooby/commit/c81479de67036993f406ccdec23990b44b0bec32
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
References
Latest 1.x version: 1.6.6
Arbitrary class path resource access 1
When sharing a File System directory as in:
assets("/static/**", Paths.get("static"));The class path is also searched for the file (org.jooby.handlers.AssetHandler.loader):
jooby/AssetHandler.java at 1.x · jooby-project/jooby · GitHub
private static Loader loader(final Path basedir, final ClassLoader classloader) {
if (Files.exists(basedir)) {
return name -> {
Path path = basedir.resolve(name).normalize();
if (Files.exists(path) && path.startsWith(basedir)) {
try {
return path.toUri().toURL();
} catch (MalformedURLException x) {
// shh
}
}
return classloader.getResource(name);
};
}
return classloader::getResource;
}If we send /static/WEB-INF/web.xml it will fail to load it from the file system but will go into classloader.getResource(name) where name equals /WEB-INF/web.xml so will succeed and return the requested file. This way we can get any configuration file or even the application class files
If assets are configured for a certain extension we can still bypass it. eg:
assets("/static/**/*.js", Paths.get("static"));We can send:
http://localhost:8080/static/io/yiss/App.class.jsArbitrary class path resource access 2
This vulnerability also affects assets configured to access resources from the root of the class path. eg:
assets("/static/**");In this case we can traverse static by sending:
http://localhost:8080/static/..%252fio/yiss/App.classFor more information
If you have any questions or comments about this advisory:
- Open an issue in jooby
- Email us at support@jooby.io
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Java / Kotlin (Maven) | io.jooby:jooby | < 2.8.2 | 2.8.2 |
| Java / Kotlin (Maven) | org.jooby:jooby | < 2.8.2 | 2.8.2 |
Referencias
- https://github.com/jooby-project/jooby/security/advisories/GHSA-px9h-x66r-8mpc
- https://nvd.nist.gov/vuln/detail/CVE-2020-7647
- https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009
- https://github.com/jooby-project/jooby
- https://snyk.io/vuln/SNYK-JAVA-IOJOOBY-568806
- https://snyk.io/vuln/SNYK-JAVA-IOJOOBY-568806,
- https://snyk.io/vuln/SNYK-JAVA-ORGJOOBY-568807
- https://snyk.io/vuln/SNYK-JAVA-ORGJOOBY-568807,
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Debilidad (CWE)
CWE-22- Plataforma
- Java / Kotlin (Maven)
- Paquete
io.jooby:jooby, org.jooby:jooby- Publicada
- 13.05.2020
- Actualizado
- 11.10.2026 12:21
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-px9h-x66r-8mpc - CC BY 4.0
Historial de vulnerabilidades: org.jooby:jooby
Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 2
- Primera → última
- 08.2019 05.2020
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Media 2
Divulgaciones por año
- 2019: 1
- 2020: 1
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
path traversal in Jooby esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.