Homepage

com.linecorp.armeria:armeria@1.30.5

  • latest version

    1.42.0

  • first published

    10 years ago

  • latest version published

    1 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the com.linecorp.armeria:armeria package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Use of Non-Canonical URL Paths for Authorization Decisions

    com.linecorp.armeria:armeria is an asynchronous HTTP/2 RPC/REST client/server library built on top of Java 8, Netty, Thrift and gRPC (armeria)

    Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions via server request-target validation in DefaultRequestTarget.slowForServer(). An unauthenticated remote attacker can send a request with a . path segment, such as /./admin/secret or /%2e/admin/secret, to skip a path-scoped decorator while FileService, Tomcat, or Jetty resolves the path to the protected resource. Servers using these services behind path-scoped authorization decorators can expose protected files or content.

    How to fix Use of Non-Canonical URL Paths for Authorization Decisions?

    Upgrade com.linecorp.armeria:armeria to version 1.43.0 or higher.

    [,1.43.0)
    • L
    Cross-site Scripting (XSS)

    com.linecorp.armeria:armeria is an asynchronous HTTP/2 RPC/REST client/server library built on top of Java 8, Netty, Thrift and gRPC (armeria)

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the listingToHtml function in AutoIndex. When FileService.autoIndex(true) serves a directory whose filenames an attacker can control, crafted names can inject HTML into the listing or create javascript: links; opening the listing or clicking a crafted link runs script in the server’s origin, allowing the attacker to steal the victim’s cookies or tokens or perform actions as them.

    Notes

    • The filename-to-HTML exploit is limited to platforms whose filesystem permits the needed characters: it is not exploitable on Windows, where characters such as < and : are disallowed in file names.

    How to fix Cross-site Scripting (XSS)?

    Upgrade com.linecorp.armeria:armeria to version 1.43.0 or higher.

    [0.80.0,1.43.0)
    • M
    Incorrect Authorization

    com.linecorp.armeria:armeria is an asynchronous HTTP/2 RPC/REST client/server library built on top of Java 8, Netty, Thrift and gRPC (armeria)

    Affected versions of this package are vulnerable to Incorrect Authorization via the getPolicy() function in CorsConfig. An attacker can make a victim’s browser send credentialed cross-origin requests and read responses from paths excluded by route() by hosting a page that requests those paths, when the server uses an any-origin CORS policy with allowCredentials(). Without credentials, the attacker can read only unauthenticated responses.

    How to fix Incorrect Authorization?

    Upgrade com.linecorp.armeria:armeria to version 1.43.0 or higher.

    [0.84.0,1.43.0)
    Go back to all versions of this package