CVE-2021-29425: Apache Commons IO Path Traversal Flaw

CVE-2021-29425 Overview

CVE-2021-29425 is a path traversal vulnerability in Apache Commons IO, a widely-used Java library that provides utility classes for file and stream operations. When invoking the FileNameUtils.normalize method with specially crafted input strings such as //../foo or \\..\\foo, the function fails to properly sanitize the path, returning the same malformed value. This behavior can enable limited path traversal attacks, potentially allowing access to files in the parent directory when the calling code uses the unsanitized result to construct file paths.

This vulnerability is particularly concerning due to the widespread adoption of Apache Commons IO across enterprise Java applications and its integration into numerous Oracle products, making it a significant supply chain security concern.

Critical Impact

Improper path normalization in FileNameUtils.normalize allows limited directory traversal to parent directories, potentially exposing sensitive files in applications that rely on this function for path sanitization.

Affected Products

• Apache Commons IO versions 2.2 through 2.6
• Debian Linux 9.0
• Oracle WebLogic Server (12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0)
• Oracle Access Manager (11.1.2.3.0, 12.2.1.3.0, 12.2.1.4.0)
• Oracle Banking Platform and Banking APIs (multiple versions)
• Oracle Communications products (Design Studio, Policy Management, Service Broker, and others)
• Oracle Retail products (XStore Point of Service, Integration Bus, Service Backbone)
• NetApp Active IQ Unified Manager (Linux, VMware vSphere, Windows)

Discovery Timeline

• April 13, 2021 - CVE-2021-29425 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-29425

Vulnerability Analysis

The vulnerability resides in the FileNameUtils.normalize() method within Apache Commons IO. This utility function is designed to normalize file paths by resolving relative path components (such as . and ..) and converting path separators to a consistent format. However, when provided with certain malformed input strings containing double dots at the path root (e.g., //../foo or \\..\\foo), the normalization logic fails to properly handle these edge cases.

Instead of rejecting or correctly resolving these invalid paths, the function returns the input unchanged, preserving the directory traversal sequences. Applications that rely on FileNameUtils.normalize() as a security control to prevent path traversal attacks may be left vulnerable when this bypass is exploited.

The attack is classified as "limited" path traversal because the bypass only allows navigation to the immediate parent directory—not arbitrary traversal up the directory tree. Nevertheless, this can still expose sensitive configuration files, credentials, or other protected resources stored one level above the application's working directory.

Root Cause

The root cause is improper input validation (CWE-20) and inadequate path traversal protection (CWE-22) in the FileNameUtils.normalize() implementation. The function does not properly validate edge cases where traversal sequences appear at or near the root of the path. The normalization algorithm processes path components iteratively but fails to account for scenarios where the resulting path would logically traverse above the root, leading to the input being returned unmodified rather than sanitized or rejected.

Attack Vector

An attacker can exploit this vulnerability by supplying a malicious file path as input to any application feature that uses FileNameUtils.normalize() for path sanitization before file access operations. The attack vector is network-accessible when the vulnerable path handling occurs in web applications, APIs, or network services.

The exploitation flow involves:

1. Identifying an application endpoint that accepts file paths or filenames as input
2. Crafting input strings using the bypass patterns (//../filename or \\..\\filename)
3. Submitting the malicious input, which passes through the faulty normalization
4. Accessing files in the parent directory of the intended base path

This vulnerability requires the application to use the return value of normalize() directly in file operations without additional validation, which is a common usage pattern given that the function is specifically designed for path sanitization.

Detection Methods for CVE-2021-29425

Indicators of Compromise

• Application logs showing file access attempts with unusual path patterns containing //../ or \\..\\ sequences
• Web server access logs with URL-encoded traversal attempts targeting file download or upload endpoints
• File system audit logs indicating access to files outside expected application directories
• Error messages revealing parent directory structures or file names

Detection Strategies

• Implement Software Composition Analysis (SCA) to identify Apache Commons IO versions 2.2 through 2.6 in application dependencies
• Deploy web application firewall (WAF) rules to detect and block path traversal patterns in HTTP requests
• Configure application-level logging to capture all inputs processed by file path handling functions
• Use static application security testing (SAST) tools to identify usage of FileNameUtils.normalize() in security-sensitive contexts

Monitoring Recommendations

• Enable verbose logging for file access operations and monitor for unexpected parent directory references
• Set up alerts for file access attempts outside designated application directories
• Monitor dependency management systems for outdated Apache Commons IO versions across the organization
• Review application error logs for path-related exceptions that may indicate exploitation attempts

How to Mitigate CVE-2021-29425

Immediate Actions Required

• Upgrade Apache Commons IO to version 2.7 or later, which contains the fix for this vulnerability
• Audit all applications using Apache Commons IO to identify vulnerable versions in your environment
• Implement additional path validation after calling FileNameUtils.normalize() to verify paths remain within expected boundaries
• Apply vendor patches for affected Oracle, NetApp, and Debian products as they become available

Patch Information

Apache has addressed this vulnerability in Apache Commons IO version 2.7 and later. Organizations should update their Maven, Gradle, or other build configurations to use the patched version. For detailed information about the fix, refer to the Apache JIRA Issue IO-556.

Oracle has released patches addressing this vulnerability in multiple Critical Patch Updates. Refer to the Oracle CPU January 2022, Oracle CPU April 2022, and Oracle CPU July 2022 advisories for specific product updates.

Workarounds

• Implement additional path validation logic after normalization to verify the resolved path does not traverse outside intended directories
• Use canonical path comparison by resolving both the base directory and target path to their canonical forms before checking containment
• Apply input validation to reject paths containing suspicious patterns before they reach the normalization function
• Consider using Java's Path.normalize() with Path.startsWith() for secure path validation as an alternative approach

# Maven dependency update example
# Update pom.xml to use patched version:
# <dependency>
#     <groupId>commons-io</groupId>
#     <artifactId>commons-io</artifactId>
#     <version>2.7</version>
# </dependency>

# Verify current Commons IO version in your project
mvn dependency:tree | grep commons-io

# Force update to latest version
mvn versions:use-latest-versions -Dincludes=commons-io:commons-io