Impact

The default implementation of Validator.getValidDirectoryPath(String, String, File, boolean) may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path.

Patches

This vulnerability is patched in release 2.3.0.0 of ESAPI. See https://github.com/ESAPI/esapi-java-legacy/releases/tag/esapi-2.3.0.0 for details.

Workarounds

Yes; in theory, one could write the own implementation of the Validator interface. This would most easily be done by sub-classing a version of the affected DefaultValidator class and then overriding the affected getValidDirectoryPath() to correct the issue. However, this is not recommended.

References

• GitHub Security Labs GHSL-2022-008
• https://nvd.nist.gov/vuln/detail/CVE-2022-23457
• Patched in commit a0d67b7

For more information

If you have any questions or comments about this advisory:

• Email one of the project co-leaders. See email addresses listed on the OWASP ESAPI wiki page, under "Leaders".
• Send email to one of the two ESAPI related Google Groups listed under Where to Find More Information on ESAPI on our README.md page.