Erlang SSH SFTP Root Directory Escape Vulnerability Fix Analysis

Vulnerability Summary Overview Vulnerability Name: SSH_FXP_FSETSTAT Root Directory Escape Vulnerability Description: In the file, the function contains a vulnerability that allows an attacker to escape the root directory by crafting malicious requests, thereby accessing or modifying unintended files. Impact Scope Affected File: Affected Function: Remediation Fixed File: Fix Content: - In the function, replace with to ensure absolute path resolution is used during path parsing, preventing path traversal. - Specific modification as follows: POC Code / Exploit Code Test File: Test Content: - Added a new test case to verify whether the fixed vulnerability has been properly resolved. - Specific test code as follows: ```erlang access_attributes_outside_root(Config) -> #{osFamily := OsFamily} = os:type(), PrivDir = prop:get_value(priv_dir, Config), {ok, Sftp} = ssh_test_lib:connect(Config, [{user_dir, ClientUserDir}, {user, ?USER}, {password, ?PASSWORD}, {user_interaction, false}, {silently_accept_hosts, true}]), {ok, Channel} = ssh_connection:session_channel(Cm, ?SSH_WINDOW_SIZE, ?SSH_PACKET_SIZE, ?SSH_TIMEOUT), success = ssh_connection:subsystem(Cm, Channel, "sftp", ?SSH_TIMEOUT), case Result of {ok, Sftp} -> Port = ssh_test_lib:daemon_port(Sftp), ProtocolVer = case atom_to_list(TestCase) of "ver2" ++ _ -> 3; _ -> ?SSH_SFTP_PROTOCOL_VERSION end, Cm = ssh_test_lib:connect(Port, [{user_dir, ClientUserDir}, {user, ?USER}, {password, ?PASSWORD}, {user_interaction, false}, {silently_accept_hosts, true}]), {ok, Channel} = ssh_connection:session_channel(Cm, ?SSH_WINDOW_SIZE, ?SSH_PACKET_SIZE, ?SSH_TIMEOUT), success = ssh_connection:subsystem(Cm, Channel, "sftp", ?SSH_TIMEOUT), case Result of {ok, Sftp} -> Port = ssh_test_lib:daemon_port(Sftp), ProtocolVer = case atom_to_list(TestCase) of "ver2" ++ _ -> 3; _ -> ?SSH_SFTP_PROTOCOL_VERSION end, Cm = ssh_test_lib:connect(Port, [{user_dir, ClientUserDir}, {user, ?USER}, {password, ?PASSWORD}, {user_interaction, false}, {silently_accept_hosts, true}]), {ok, Channel} = ssh_connection:session_channel(Cm, ?SSH_WINDOW_SIZE, ?SSH_PACKET_SIZE, ?SSH_TIMEOUT), success = ssh_connection:subsystem(Cm, Channel, "sftp", ?SSH_TIMEOUT), case Result of {ok, Sftp} -> Port = ssh_test_lib:daemon_port(Sftp), ProtocolVer = case atom_to_list(TestCase) of "ver2" ++ _ -> 3; _ -> ?SSH_SFTP_PROTOCOL_VERSION end, Cm = ssh_test_lib:connect(Port, [{user_dir, ClientUserDir}, {user, ?USER}, {password, ?PASSWORD}, {user_interaction, false}, {silently_accept_hosts, true}]), {ok, Channel} = ssh_connection:session_channel(Cm, ?SSH_WINDOW_SIZE, ?SSH_PACKET_SIZE, ?SSH_TIMEOUT), success = ssh_connection:subsystem(Cm, Channel, "sftp", ?SSH_TIMEOUT), case Result of {ok, Sftp} -> Port = ssh_test_lib:daemon_port(Sftp), ProtocolVer = case atom_to_list(TestCase) of "ver2" ++ _ -> 3; _ -> ?SSH_SFTP_PROTOCOL_VERSION end, Cm = ssh_test_lib:connect(Port, [{user_dir, ClientUserDir}, {user, ?USER}, {password, ?PASSWORD}, {user_interaction, false}, {silently_accept_hosts, true}]), {ok, Channel} = ssh_connection:session_channel(Cm, ?SSH_WINDOW_SIZE, ?SSH_PACKET_SIZE, ?SSH_TIMEOUT), success = ssh_connection:subsystem(Cm, Channel, "sftp", ?SSH_TIMEOUT), case Result of {ok, Sftp} -> Port = ssh_test_lib:daemon_port(Sftp), ProtocolVer = case atom_to_list(TestCase) of "ver2" ++ _ -> 3; _ -> ?SSH_SFTP_PROTOCOL_VERSION end, Cm = ssh_test_lib:connect(Port, [{user_dir, ClientUserDir}, {user, ?USER}, {password, ?PASSWORD}, {user_interaction, false}, {silently_accept_hosts, true}]), {ok, Channel} = ssh_connection:session_channel(Cm, ?SSH_WINDOW_SIZE, ?SSH_PACKET_SIZE, ?SSH_TIMEOUT), success = ssh_connection:subsystem(Cm, Channel, "sftp", ?SSH_TIMEOUT), case Result of {ok, Sftp} -> Port = ssh_test_lib:daemon_port(Sftp), ProtocolVer = case atom_to_list(TestCase) of "ver2" ++ _ -> 3; _ -> ?SSH_SFTP_PROTOCOL_VERSION end, Cm = ssh_test_lib:connect(Port, [{user_dir, ClientUserDir}, {user, ?USER}, {password, ?PASSWORD}, {user_interaction, false}, {silently_accept_hosts, true}]), {ok, Channel} = ssh_connection:session_channel(Cm, ?SSH_WINDOW_SIZE, ?SSH_PACKET_SIZE, ?SSH_TIMEOUT), success = ssh_connection:subsystem(Cm, Channel, "sftp", ?SSH_TIMEOUT), case Result of {ok, Sftp} -> Port = ssh_test_lib:daemon_port(Sftp), ProtocolVer = case atom_to_list(TestCase) of "ver2" ++ _ -> 3; _ -> ?SSH_SFTP_PROTOCOL_VERSION end, Cm = ssh_test_lib:connect(Port, [{user_dir, ClientUserDir}, {user, ?USER}, {password, ?PASSWORD}, {user_interaction, false}, {silently_accept_hosts, true}]), {ok, Channel} = ssh_connection:session_channel(Cm, ?SSH_WINDOW_SIZE, ?SSH_PACKET_SIZE, ?SSH_TIMEOUT), success = ssh_connection:subsystem(Cm, Channel, "sftp", ?SSH_TIMEOUT), case Result of {ok, Sftp} -> Port = ssh_test_lib:daemon_port(Sftp), ProtocolVer = case atom_to_list(TestCase) of "ver2" ++ _ -> 3; _ -> ?SSH_SFTP_PROTOCOL_VERSION end, Cm = ssh_test_lib:connect(Port, [{user_dir, ClientUserDir}, {user, ?USER}, {password, ?PASSWORD}, {user_interaction, false}, {silently_accept_ho

Goal Reached Thanks to every supporter — we hit 100%!

Erlang SSH SFTP Root Directory Escape Vulnerability Fix Analysis

More from this source