{"id":"CVE-2024-36117","aliases":["GHSA-82j3-hf72-7x93"],"url":"https://o3.security/vulnerability/CVE-2024-36117","summary":"Path traversal while serving Reposilite javadoc expanded files","details":"### Summary\nReposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files.\n\n### Details\nThe problem lies in the way how the expanded javadoc files are served. The `GET /javadoc/{repository}/<gav>/raw/<resource>` route uses the `<resource>` path parameter to find the file in the `javadocUnpackPath` directory and returns it's content to the user.\n\n[JavadocFacade.kt#L77](https://github.com/dzikoysk/reposilite/blob/68b73f19dc9811ccf10936430cf17f7b0e622bd6/reposilite-backend/src/main/kotlin/com/reposilite/javadocs/JavadocFacade.kt#L77):\n\n```kotlin\nfun findRawJavadocResource(request: JavadocRawRequest): Result<JavadocRawResponse, ErrorResponse> =\n   with (request) {\n       mavenFacade.canAccessResource(accessToken, repository, gav)\n           .flatMap { javadocContainerService.loadContainer(accessToken, repository, gav) }\n           .filter({ Files.exists(it.javadocUnpackPath.resolve(resource.toString())) }, { notFound(\"Resource $resource not found\") })\n           .map {\n               JavadocRawResponse(\n                   contentType = supportedExtensions[resource.getExtension()] ?: ContentType.APPLICATION_OCTET_STREAM,\n                   content = Files.newInputStream(it.javadocUnpackPath.resolve(resource.toString()))\n               )\n           }\n   }\n```\n\nIn this case, the `<resource>` path parameter can contain path traversal characters such as `/../../`. Since the path is concatenated with the main directory, it opens the possibility to read files outside the `javadocUnpackPath` directory.\n\n#### Impact\n\nThis issue may lead to Arbitrary File Read on the server. A potential attacker can read some sensitive file, such as `reposilite.db`, that contains the sqlite database used by Reposilite. This database contains the sensitive information used by Reposilite, including passwords and hashes of issued tokens. Also, the `configuration.cdn` file can be read, which contains other sensitive properties.\n\n### Steps to reproduce\n\n1. Start the Reposilite instance on http://localhost:8080/\n2. Find at least one javadoc file in the hosted repositories. For example, the default test workspace contains the `/releases/javadoc/1.0.0/javadoc-1.0.0-javadoc.jar` archive that is suitable for our attack.\n3. Send a GET request to http://127.0.0.1:8080/javadoc/releases/javadoc/1.0.0/raw/%2e%2e%5c%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2freposilite.db\nWhen this request is processed on the server, Reposilite tries to unpack the `/repositories/releases/javadoc/1.0.0/javadoc-1.0.0-javadoc.jar` file into the `/javadocs/releases/javadoc/1.0.0/.cache/unpack` folder. Then, it tries to read the `../../../../../../reposilite.db` file from this folder, which triggers the path traversal attack.\n\n![image](https://github.com/dzikoysk/reposilite/assets/44605151/2f2638e2-2b6a-498d-9ca3-bacc84041d8a)\n\n### Remediation\n\nNormalize (remove all occurrences of `/../`) the `<resource>` path parameter before using it when reading the file. For example:\n\n```kotlin\ncontent = Files.newInputStream(it.javadocUnpackPath.resolve(resource.toPath()))\n```\n\nChanging `resource.toString()` to `resource.toPath()` is enough here as the `com.reposilite.storage.api.Location#toPath` method normalizes the string internally.\n","published":"2024-06-19T17:37:24.404Z","modified":"2026-08-12T03:51:35.032581546Z","cvss":{"score":8.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"com.reposilite:reposilite-backend","fixedVersion":"3.5.12"}],"fix":{"url":"https://github.com/dzikoysk/reposilite/commit/e172ae4b539c822d0d6e04cf090713c7202a79d6","label":"dzikoysk/reposilite@e172ae4"},"references":[{"type":"WEB","url":"https://github.com/dzikoysk/reposilite/releases/tag/3.5.12"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36117.json"},{"type":"ADVISORY","url":"https://github.com/dzikoysk/reposilite/security/advisories/GHSA-82j3-hf72-7x93"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36117"},{"type":"FIX","url":"https://github.com/dzikoysk/reposilite/commit/e172ae4b539c822d0d6e04cf090713c7202a79d6"},{"type":"PACKAGE","url":"https://github.com/dzikoysk/reposilite"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:35.032581546Z"}}