References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Known Affected Software Configurations Switch to CPE 2.2

Change History

OR
          *cpe:2.3:a:netfoundry:zrok:*:*:*:*:*:*:*:* versions up to (excluding) 2.0.2

GitHub, Inc.: https://github.com/openziti/zrok/commit/459bcfc1e121decae1b1d11c37ad94e4ed5bbf2e Types: Patch

GitHub, Inc.: https://github.com/openziti/zrok/releases/tag/v2.0.2 Types: Product, Release Notes

GitHub, Inc.: https://github.com/openziti/zrok/security/advisories/GHSA-74m3-9qvm-rp9h Types: Vendor Advisory

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files and—on shares without OS-level permission restrictions—write or overwrite files anywhere on the host filesystem accessible to the zrok process. This issue has been patched in version 2.0.2.

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

CWE-22

CWE-61

https://github.com/openziti/zrok/commit/459bcfc1e121decae1b1d11c37ad94e4ed5bbf2e

https://github.com/openziti/zrok/releases/tag/v2.0.2

https://github.com/openziti/zrok/security/advisories/GHSA-74m3-9qvm-rp9h