id: GO-2020-0032
modules:
    - module: github.com/goadesign/goa
      versions:
        - fixed: 1.4.3
      vulnerable_at: 1.4.3-0.20191129212618-4f2e80285f2e
      packages:
        - package: github.com/goadesign/goa
          symbols:
            - Controller.FileHandler
          derived_symbols:
            - Service.ListenAndServe
            - Service.ListenAndServeTLS
            - Service.Serve
            - mux.ServeHTTP
    - module: goa.design/goa
      versions:
        - fixed: 1.4.3
      vulnerable_at: 1.4.3-0.20191129212618-4f2e80285f2e
      packages:
        - package: goa.design/goa
          symbols:
            - Controller.FileHandler
          skip_fix: 'TODO: revisit this reason (cannot find module providing package github.com/goadesign/goa/uuid)'
    - module: goa.design/goa/v3
      versions:
        - fixed: 3.0.9
      vulnerable_at: 3.0.8
      packages:
        - package: goa.design/goa/v3
          symbols:
            - Controller.FileHandler
          skip_fix: 'TODO: revisit this reason (goa.design/goa/v3 appears to not be a package, but I could not locate the fix for this issue in v3)'
summary: Path traversal in github.com/goadesign/goa
description: |-
    Due to improper sanitization of user input, Controller.FileHandler allows for
    directory traversal, allowing an attacker to read files outside of the target
    directory that the server has permission to read.
published: 2021-04-14T20:04:52Z
ghsas:
    - GHSA-fjgq-224f-fq37
credits:
    - '@christi3k'
references:
    - fix: https://github.com/goadesign/goa/pull/2388
    - fix: https://github.com/goadesign/goa/commit/70b5a199d0f813d74423993832c424e1fc73fb39
cve_metadata:
    id: CVE-2019-25073
    cwe: 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory(''Path Traversal'')'
    description: |-
        Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10,
        or v1.4.3 allow remote attackers to read files outside of the intended
        directory.