Path Traversal vulnerability

hyperledger / fabric-chaincode-java

Hyperledger Fabric Contract and Chaincode implementation for Java

https://hyperledger.github.io/fabric-chaincode-java/

Apache License 2.0

304 stars 207 forks source link

Path Traversal vulnerability #251

Closed bhaskarvilles closed 2 years ago

bhaskarvilles commented 2 years ago

Primary Changes to /fabric-chaincode-integration-test/src/contracts/bare-maven/.mvn/wrapper/MavenWrapperDownloader.java

Description:-

Unsanitized input from a command line argument flows into java.io.FileOutputStream, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to write to arbitrary files.