Listen to this Post
The vulnerability exists in the `HttpClient.java` component of Dreampie Resty’s HTTP client module. The flaw is specifically located within the `readResponse` method, which handles file downloads. When a server responds with a file, this method extracts the intended filename from the `Content-Disposition` header in the HTTP response. The core issue is that the extracted `fileName` variable is not validated or sanitized for path traversal sequences. An attacker controlling a malicious server can craft a response where the filename contains directory traversal characters, such as ../../../etc/passwd. When the vulnerable client application processes this response, it concatenates this malicious filename with a target directory path. This unsanitized concatenation results in a final file path that escapes the intended download directory. Consequently, the file is written to an arbitrary location on the client’s filesystem where the application has write permissions. This attack can be triggered through any HTTP method that initiates a download, including get(), post(), put(), patch(), or delete(). The exploit requires the client to connect to an attacker-controlled server, making the attack complex but feasible remotely. Successful exploitation can lead to unauthorized file creation or overwrite, potentially affecting system integrity and confidentiality.
Platform: Dreampie Resty
Version: <=1.3.1.SNAPSHOT
Vulnerability: Path Traversal
Severity: Medium
Date: 2025-11-20
Prediction: No patch expected
What Undercode Say:
Showing bash commands and codes related to the blog
Example curl command for a path traversal attack targeting a sensitive file curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa Structure of a malicious zip archive for a file write attack (Zip-Slip) The filename includes path traversal to overwrite a critical file: ../../../../../../root/.ssh/authorized_keys
How Exploit:
An attacker operates a malicious HTTP server. When a vulnerable Dreampie Resty client downloads a file from this server, the attacker supplies a crafted `Content-Disposition` header. This header contains a filename with path traversal sequences, like ../../../../tmp/exploit.txt. The client’s vulnerable `readResponse` method uses this unsanitized name to save the file, writing it outside the intended directory.
Protection from this CVE:
No official patch is available for the `cn.dreampie:resty-httpclient` package. Users should avoid using the vulnerable version. Implement strict input validation and path sanitization for all user-supplied or external filenames. Use security tools to monitor for directory traversal attempts.
Impact:
The vulnerability has a medium severity rating. It can lead to limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L). A successful attack allows arbitrary file write on the client system, which could result in data theft, system compromise, or malware deployment. The attack complexity is high, and exploitability is difficult.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
