Description
Directory Traversal is a vulnerability which allows attackers to access restricted directories and execute commands outside of the web server's root directory.
The following programs are vulnerable.
Programs that publish files using WEBrick::HTTPServer.new with the :DocumentRoot option
Programs that publish files using WEBrick::HTTPServlet::FileHandler
Affected systems are:
1. Systems that accept backslash (\) as a path separator, such as Windows.
2. Systems that use case insensitive file-systems such as NTFS on Windows, HFS on Mac OS X.
Remediation
Your script should filter metacharacters from user input.
References
Related Vulnerabilities
WordPress 4.4.x Multiple Vulnerabilities (4.4 - 4.4.1)
Oracle Database Server Other Vulnerability (CVE-2001-0833)
Artifactory Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-10324)
WordPress Plugin NextGEN Gallery-WordPress Gallery 'swfupload.swf' Cross-Site Scripting (1.9.7)
Dolibarr Incorrect Authorization Vulnerability (CVE-2021-25954)