Relative Path Traversal in jitsi/jicofo

Valid

Reported on

Nov 15th 2021


Description

misconfigurations of nginx lead to a path traversal vulnerability.

Proof of Concept

according to https://github.com/jitsi/jicofo/blob/master/doc/shibboleth.md?plain=1#L251

a request to /shibboleth-sp../ can get any file under /usr/share

Impact

An attacker can access files on the web server to which they should not have access.

We are processing your report and will contact the jitsi/jicofo team within 24 hours. 16 days ago
Dig2 submitted a
16 days ago
We have contacted a member of the jitsi/jicofo team and are waiting to hear back 15 days ago
jitsi/jicofo maintainer validated this vulnerability 15 days ago
Dig2 has been awarded the disclosure bounty
The fix bounty is now up for grabs
jitsi/jicofo maintainer confirmed that a fix has been merged on f4ba60 14 days ago
Dig2 has been awarded the fix bounty