Loading vulnerability…
Netty Multipart Decoder Insecure Temporary File Permissions
CVE-2022-24823 is an insufficient remediation of CVE-2021-21290 in Netty's HTTP codec before 4.1.77.Final. When multipart decoders are configured to store uploaded data on disk, temporary files may be created in a system-wide temporary directory with permissions that allow other local users to read their contents. The flaw is associated with insecure temporary-file creation and permits exposure of sensitive multipart upload data.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A separate unprivileged local user may read sensitive data written by an affected application to temporary multipart-upload files. The vulnerability is an information-disclosure issue; no remote code execution or privilege escalation impact is established by the available information.
If you can’t patch tonight, do this now.
Configure the JVM to use a dedicated java.io.tmpdir directory accessible only to the application user, or configure Netty's DefaultHttpDataFactory with a restricted per-application base directory for temporary upload storage. Ensure the selected directory and its parent permissions prevent access by other local users.
Patch, then assume compromise.
Upgrade Netty to version 4.1.77.Final or a vendor-supported release incorporating the fix. Apply the corresponding security updates for products that bundle the affected Netty version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.