CVE-2024-36117: Reposilite Path Traversal Vulnerability

CVE-2024-36117 Overview

CVE-2024-36117 is a path traversal vulnerability [CWE-22] in Reposilite, an open source repository manager for Maven-based artifacts in the Java Virtual Machine (JVM) ecosystem. Reposilite version 3.5.10 is affected by an arbitrary file read flaw triggered while serving expanded Javadoc files. Unauthenticated attackers can traverse the file system over the network and read files outside the intended Javadoc directory. The maintainers fixed the issue in Reposilite version 3.5.12. The GitHub Security Lab discovered and reported the vulnerability, which is also tracked as GHSL-2024-074.

Critical Impact
Remote, unauthenticated attackers can read arbitrary files accessible to the Reposilite process by abusing path traversal sequences in requests for expanded Javadoc resources.

Affected Products

Reposilite 3.5.10
Reposilite versions prior to 3.5.12
Self-hosted Maven repositories using vulnerable Reposilite builds

Discovery Timeline

Vulnerability discovered and reported by the GitHub Security Lab (tracked as GHSL-2024-074)
2024-06-19 - CVE-2024-36117 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-36117

Vulnerability Analysis

Reposilite exposes a frontend handler that serves expanded Javadoc archives over HTTP. The handler in FrontendHandler.kt resolves user-supplied path segments against the Javadoc extraction directory before reading the requested file. Because the handler did not normalize and validate the resolved path against the intended base directory, attackers can submit traversal sequences such as ../ to escape the Javadoc root.

The attack requires no authentication, no user interaction, and only network access to the Reposilite instance. Confidentiality impact is high because the process can read any file readable by the service account, including configuration files, credentials, and repository internals. Integrity and availability are not directly affected by this read-only primitive.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory while constructing the file path used to serve Javadoc content. The handler concatenated or resolved untrusted input without enforcing that the canonicalized result remained within the Javadoc base directory.

Attack Vector

An attacker issues an HTTP request to the Javadoc-serving endpoint and embeds path traversal segments in the resource path. The server resolves the path, opens the file outside the Javadoc directory, and returns its contents in the HTTP response. The fix applied in commit e172ae4b539c822d0d6e04cf090713c7202a79d6 adjusts the frontend handler to make the location safer to use out-of-the-box.

text

 import com.reposilite.storage.inputStream
 import com.reposilite.web.api.ReposiliteRoute
 import com.reposilite.web.api.ReposiliteRoutes
-import io.javalin.community.routing.Route
 import io.javalin.community.routing.Route.GET
 import io.javalin.http.ContentType
 import io.javalin.http.Context
 import io.javalin.http.HttpStatus.INTERNAL_SERVER_ERROR
-import panda.std.Result
-import panda.std.asSuccess
 import java.io.InputStream
 import java.nio.charset.StandardCharsets.UTF_8
 import java.nio.file.Files
 import java.nio.file.Path
 import kotlin.io.path.isDirectory
 import kotlin.streams.asSequence
+import panda.std.Result
+import panda.std.asSuccess

 internal sealed class FrontendHandler(private val frontendFacade: FrontendFacade) : ReposiliteRoutes() {

Source: GitHub Commit for Reposilite

Detection Methods for CVE-2024-36117

Indicators of Compromise

HTTP requests containing encoded or raw traversal sequences such as ../, ..%2f, or ..%5c directed at Javadoc-serving endpoints.
Outbound responses from Reposilite returning non-Javadoc content types or file contents inconsistent with repository artifacts.
Access log entries showing successful 200 OK responses for paths that include parent-directory references.

Detection Strategies

Inspect Reposilite access logs and reverse proxy logs for URI patterns that include traversal tokens targeting Javadoc routes.
Deploy web application firewall (WAF) rules that decode and normalize request paths before evaluating them against traversal signatures.
Correlate file read events on the host with HTTP requests to Reposilite to identify reads outside the configured Javadoc extraction directory.

Monitoring Recommendations

Alert on any process spawned by Reposilite that touches sensitive configuration files such as configuration.cdn or credential stores.
Monitor the running Reposilite version and flag instances below 3.5.12 during routine asset inventory.
Track network egress for unexpected large responses from Reposilite endpoints that could indicate bulk file exfiltration.

How to Mitigate CVE-2024-36117

Immediate Actions Required

Upgrade Reposilite to version 3.5.12 or later, which contains the fix from commit e172ae4b539c822d0d6e04cf090713c7202a79d6.
Restrict network exposure of Reposilite to trusted networks or place it behind an authenticating reverse proxy until patching is complete.
Audit Reposilite host file systems for sensitive data that would be exposed if a successful read occurred.

Patch Information

The vendor addressed CVE-2024-36117 in Reposilite 3.5.12. The fix is documented in the GitHub Security Advisory GHSA-82j3-hf72-7x93 and shipped with the Reposilite 3.5.12 release. Operators should validate the deployed binary or container image against the fixed version after upgrade.

Workarounds

No vendor-supplied workarounds exist; upgrading to 3.5.12 is required to fully remediate the issue.
As an interim compensating control, block requests containing traversal sequences at an upstream reverse proxy or WAF.
Run Reposilite under a dedicated low-privilege service account whose file system access is limited to the repository directories.

bash

# Verify the running Reposilite version and upgrade if vulnerable
java -jar reposilite.jar --version

# Example reverse proxy rule (nginx) to block obvious traversal attempts
# location / {
#     if ($request_uri ~* "\.\./|%2e%2e/|%2e%2e%2f") { return 400; }
#     proxy_pass http://reposilite_backend;
# }