正文

datadoghq datadog-api-client-java 创建拥有不安全权限的临时文件

admin
admin V管理员 /0 评论 /13 阅读
0418
此篇文章发布距今已超过1114天，您需要注意文章的内容或图片是否可用！

CVE编号

CVE-2021-21331

利用情况

暂无

补丁情况

N/A

披露时间

2021-03-04
漏洞描述
The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the API Client. The Datadog API is executed on a unix-like system with multiple users. The API is used to download a file containing sensitive information. This sensitive information is exposed locally to other users. This vulnerability exists in the API Client for version 1 and 2. The method `prepareDownloadFilecreates` creates a temporary file with the permissions bits of `-rw-r--r--` on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded via the `downloadFileFromResponse` method will be visible to all other users on the local system. Analysis of the finding determined that the affected code was unused, meaning that the exploitation likelihood is low. The unused code has been removed, effectively mitigating this issue. This issue has been patched in version 1.0.0-beta.9. As a workaround one may specify `java.io.tmpdir` when starting the JVM with the flag `-Djava.io.tmpdir`, specifying a path to a directory with `drw-------` permissions owned by `dd-agent`.
解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接
https://github.com/DataDog/datadog-api-client-java/releases/tag/datadog-api-c...
https://github.com/DataDog/datadog-api-client-java/security/advisories/GHSA-2...
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 datadoghq datadog-api-client-java 1.0.0 -
CVSS3评分 3.3
  • 攻击路径 本地
  • 攻击复杂度 低
  • 权限要求 无
  • 影响范围 未更改
  • 用户交互 需要
  • 可用性 无
  • 保密性 低
  • 完整性 无
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CWE-ID 漏洞类型 CWE-378 创建拥有不安全权限的临时文件 CWE-379 在具有不安全权限的目录中创建临时文件 NVD-CWE-Other