CVE-2017-6200 - Vulnerability Details - OpenCVE

Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. The root cause is that the findFilesToZip function doesn't filter Line Feed (\n) characters in a directory name.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Sandstorm	Sandstorm

Configuration 1 [-]

cpe:2.3:a:sandstorm:sandstorm:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/
https://github.com/sandstorm-io/sandstorm/blob/v0.202/src/sandstorm/backup.c%2B%2B#L271
https://github.com/sandstorm-io/sandstorm/commit/4ea8df7403381d9b657b121b3c98d8081b27414d
https://github.com/sandstorm-io/sandstorm/commit/6e8572ea8bb56d0216bb1b410e5040edc051b120
https://sandstorm.io/news/2017-03-02-security-review

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2018-02-06T16:00:00

Updated: 2024-08-05T15:25:49.028Z

Reserved: 2017-02-22T00:00:00

Link: CVE-2017-6200

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-02-06T16:29:00.790

Modified: 2024-11-21T03:29:14.687

Link: CVE-2017-6200

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-03-01T00:00:00", "descriptions": [{"lang": "en", "value": "Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. The root cause is that the findFilesToZip function doesn't filter Line Feed (\\n) characters in a directory name."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-02-06T15:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sandstorm-io/sandstorm/commit/4ea8df7403381d9b657b121b3c98d8081b27414d"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sandstorm-io/sandstorm/commit/6e8572ea8bb56d0216bb1b410e5040edc051b120"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/sandstorm-io/sandstorm/blob/v0.202/src/sandstorm/backup.c%2B%2B#L271"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://sandstorm.io/news/2017-03-02-security-review"}, {"tags": ["x_refsource_MISC"], "url": "https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-6200", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. The root cause is that the findFilesToZip function doesn't filter Line Feed (\\n) characters in a directory name."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/sandstorm-io/sandstorm/commit/4ea8df7403381d9b657b121b3c98d8081b27414d", "refsource": "CONFIRM", "url": "https://github.com/sandstorm-io/sandstorm/commit/4ea8df7403381d9b657b121b3c98d8081b27414d"}, {"name": "https://github.com/sandstorm-io/sandstorm/commit/6e8572ea8bb56d0216bb1b410e5040edc051b120", "refsource": "CONFIRM", "url": "https://github.com/sandstorm-io/sandstorm/commit/6e8572ea8bb56d0216bb1b410e5040edc051b120"}, {"name": "https://github.com/sandstorm-io/sandstorm/blob/v0.202/src/sandstorm/backup.c%2B%2B#L271", "refsource": "MISC", "url": "https://github.com/sandstorm-io/sandstorm/blob/v0.202/src/sandstorm/backup.c%2B%2B#L271"}, {"name": "https://sandstorm.io/news/2017-03-02-security-review", "refsource": "CONFIRM", "url": "https://sandstorm.io/news/2017-03-02-security-review"}, {"name": "https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/", "refsource": "MISC", "url": "https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T15:25:49.028Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/sandstorm-io/sandstorm/commit/4ea8df7403381d9b657b121b3c98d8081b27414d"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/sandstorm-io/sandstorm/commit/6e8572ea8bb56d0216bb1b410e5040edc051b120"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/sandstorm-io/sandstorm/blob/v0.202/src/sandstorm/backup.c%2B%2B#L271"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://sandstorm.io/news/2017-03-02-security-review"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-6200", "datePublished": "2018-02-06T16:00:00", "dateReserved": "2017-02-22T00:00:00", "dateUpdated": "2024-08-05T15:25:49.028Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sandstorm:sandstorm:*:*:*:*:*:*:*:*", "matchCriteriaId": "683ED5F0-D297-4A47-ADF9-186832F3A3AD", "versionEndExcluding": "0.203", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. The root cause is that the findFilesToZip function doesn't filter Line Feed (\\n) characters in a directory name."}, {"lang": "es", "value": "Sandstorm antes de la build 0.203 permite que atacantes remotos lean cualquier archivo especificado bajo /etc o /run mediante la funci\u00f3n de copia de seguridad del sandbox. La causa principal es que la funci\u00f3n findFilesToZip no filtra los caracteres nueva l\u00ednea (\\n) en un nombre de directorio."}], "id": "CVE-2017-6200", "lastModified": "2024-11-21T03:29:14.687", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-02-06T16:29:00.790", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/sandstorm-io/sandstorm/blob/v0.202/src/sandstorm/backup.c%2B%2B#L271"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/sandstorm-io/sandstorm/commit/4ea8df7403381d9b657b121b3c98d8081b27414d"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/sandstorm-io/sandstorm/commit/6e8572ea8bb56d0216bb1b410e5040edc051b120"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://sandstorm.io/news/2017-03-02-security-review"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/sandstorm-io/sandstorm/blob/v0.202/src/sandstorm/backup.c%2B%2B#L271"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/sandstorm-io/sandstorm/commit/4ea8df7403381d9b657b121b3c98d8081b27414d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/sandstorm-io/sandstorm/commit/6e8572ea8bb56d0216bb1b410e5040edc051b120"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://sandstorm.io/news/2017-03-02-security-review"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}