Summary
A path traversal vulnerability in Goobi viewer allows attacker-controlled response headers to influence where downloaded content is written on the server. If the viewer fetches content from a malicious HTTP server, crafted absolute paths or traversal sequences may cause arbitrary file writes and, in some deployments, remote code execution as the Tomcat operating-system user.
A path traversal vulnerability in Goobi viewer allows attacker-controlled response headers to influence where downloaded content is written on the server. If the viewer fetches content from a malicious HTTP server, crafted absolute paths or traversal sequences may cause arbitrary file writes and, in some deployments, remote code execution as the Tomcat operating-system user.
Affected context
The issue occurs in the Goobi viewer's external file download functionality when a server-supplied Content-Disposition filename is used to construct a destination path. Deployments are at risk when the application can fetch content from an attacker-controlled or compromised HTTP server and the Tomcat process has write access to sensitive locations, including the deployed web-application directory.
The issue occurs in the Goobi viewer's external file download functionality when a server-supplied Content-Disposition filename is used to construct a destination path. Deployments are at risk when the application can fetch content from an attacker-controlled or compromised HTTP server and the Tomcat process has write access to sensitive locations, including the deployed web-application directory.
Exploit preconditions
- Attack surface: External file retrieval performed by the Goobi viewer
- Required access: Ability to cause the viewer to fetch from, or otherwise trust responses from, a malicious HTTP server
- Trigger point: Processing the Content-Disposition response header and resolving the destination filename
- Why exploitation is possible: Directory components are accepted without adequate containment checks, allowing absolute paths or traversal sequences to escape the intended download directory
- Attack surface: External file retrieval performed by the Goobi viewer
- Required access: Ability to cause the viewer to fetch from, or otherwise trust responses from, a malicious HTTP server
- Trigger point: Processing the Content-Disposition response header and resolving the destination filename
- Why exploitation is possible: Directory components are accepted without adequate containment checks, allowing absolute paths or traversal sequences to escape the intended download directory
Why this happens
The vulnerable code derives a local filename from an HTTP response header and passes it to path resolution without removing directory components or verifying that the resulting path remains within an approved directory. This is a path traversal issue mapped to CWE-22, with characteristics of improper control over a resource identifier under CWE-73. The insecure pattern combines attacker-influenced path data with filesystem operations and insufficient canonicalization or boundary validation.
The vulnerable code derives a local filename from an HTTP response header and passes it to path resolution without removing directory components or verifying that the resulting path remains within an approved directory. This is a path traversal issue mapped to CWE-22, with characteristics of improper control over a resource identifier under CWE-73. The insecure pattern combines attacker-influenced path data with filesystem operations and insufficient canonicalization or boundary validation.
Potential impact
- Attacker-controlled files may be written to arbitrary locations writable by the Tomcat process
- Application files, configuration, or other server data may be overwritten
- The deployed web application may be modified
- Arbitrary code may execute with the privileges of the Tomcat operating-system user
- The host or connected services could be compromised further
- Attacker-controlled files may be written to arbitrary locations writable by the Tomcat process
- Application files, configuration, or other server data may be overwritten
- The deployed web application may be modified
- Arbitrary code may execute with the privileges of the Tomcat operating-system user
- The host or connected services could be compromised further
General mitigation guidance
Mitigation generally focuses on treating response-derived filenames as untrusted data and enforcing a strict destination boundary.
Common defensive patterns include:
- Discarding directory components and accepting only a safe basename
- Allowing only constrained filename characters and lengths
- Resolving paths against a fixed download directory and verifying the normalized result remains inside that directory
- Using generated server-side filenames rather than client- or server-supplied names where practical
- Restricting outbound fetch targets and validating redirect destinations
- Running Tomcat with the least filesystem privileges necessary
- Keeping deployed application directories non-writable by the application process where feasible
Mitigation generally focuses on treating response-derived filenames as untrusted data and enforcing a strict destination boundary.
Common defensive patterns include:
- Discarding directory components and accepting only a safe basename
- Allowing only constrained filename characters and lengths
- Resolving paths against a fixed download directory and verifying the normalized result remains inside that directory
- Using generated server-side filenames rather than client- or server-supplied names where practical
- Restricting outbound fetch targets and validating redirect destinations
- Running Tomcat with the least filesystem privileges necessary
- Keeping deployed application directories non-writable by the application process where feasible
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis rules that identify external header values reaching filesystem path APIs
- Code review checks for direct use of Content-Disposition filenames in path construction
- Tests using absolute paths, parent-directory components, encoded separators, and platform-specific path forms
- Runtime monitoring for unexpected writes outside designated download directories
- Filesystem and application policies that alert on modifications to deployed web-application content
- Automated security review tools configured to detect path traversal and arbitrary file-write data flows
Organizations can look for this weakness through:
- Static analysis rules that identify external header values reaching filesystem path APIs
- Code review checks for direct use of Content-Disposition filenames in path construction
- Tests using absolute paths, parent-directory components, encoded separators, and platform-specific path forms
- Runtime monitoring for unexpected writes outside designated download directories
- Filesystem and application policies that alert on modifications to deployed web-application content
- Automated security review tools configured to detect path traversal and arbitrary file-write data flows
