CVE-2021-21290

Vulnerability Details

On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems.

The method File.createTempFile on unix-like systems creates a random file, but, by default will create this file with the permissions -rw-r--r--. Thus, if sensitive information is written to this file, other local users can read this information.

This is the case in netty's AbstractDiskHttpData is vulnerable.

https://github.com/netty/netty/blob/e5951d46fc89db507ba7d2968d2ede26378f0b04/codec-http/src/main/java/io/netty/handler/codec/http/multipart/AbstractDiskHttpData.java#L80-L101

AbstractDiskHttpData is used as a part of the DefaultHttpDataFactory class which is used by HttpPostRequestDecoder / HttpPostMultiPartRequestDecoder.

You may be affected by this vulnerability your project contains the following code patterns:

channelPipeline.addLast(new HttpPostRequestDecoder(...));

channelPipeline.addLast(new HttpPostMultiPartRequestDecoder(...));

Workarounds

Specify your own java.io.tmpdir when you start the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.

References

• CWE-378: Creation of Temporary File With Insecure Permissions
• CWE-379: Creation of Temporary File in Directory with Insecure Permissions

Similar Vulnerabilities

Similar, but not the same.

• JUnit 4 - https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp
• Google Guava - https://github.com/google/guava/issues/4011
• Apache Ant - https://nvd.nist.gov/vuln/detail/CVE-2020-1945
• JetBrains Kotlin Compiler - https://nvd.nist.gov/vuln/detail/CVE-2020-15824

For more information

If you have any questions or comments about this advisory:

• Open an issue in netty
• Email us here

Original Report

Hi Netty Security Team,

I've been working on some security research leveraging custom CodeQL queries to detect local information disclosure vulnerabilities in java applications. This was the result from running this query against the netty project:
https://lgtm.com/query/7723301787255288599/

Netty contains three local information disclosure vulnerabilities, so far as I can tell.

One is here, where the private key for the certificate is written to a temporary file.

https://github.com/netty/netty/blob/e5951d46fc89db507ba7d2968d2ede26378f0b04/handler/src/main/java/io/netty/handler/ssl/util/SelfSignedCertificate.java#L316-L346

One is here, where the certificate is written to a temporary file.

https://github.com/netty/netty/blob/e5951d46fc89db507ba7d2968d2ede26378f0b04/handler/src/main/java/io/netty/handler/ssl/util/SelfSignedCertificate.java#L348-L371

The final one is here, where the 'AbstractDiskHttpData' creates a temporary file if the getBaseDirectory() method returns null. I believe that 'AbstractDiskHttpData' is used as a part of the file upload support? If this is the case, any files uploaded would be similarly vulnerable.

https://github.com/netty/netty/blob/e5951d46fc89db507ba7d2968d2ede26378f0b04/codec-http/src/main/java/io/netty/handler/codec/http/multipart/AbstractDiskHttpData.java#L91

All of these vulnerabilities exist because File.createTempFile(String, String) will create a temporary file in the system temporary directory if the 'java.io.tmpdir' system property is not explicitly set. It is my understanding that when java creates a file, by default, and using this method, the permissions on that file utilize the umask. In a majority of cases, this means that the file that java creates has the permissions: -rw-r--r--, thus, any other local user on that system can read the contents of that file.

Impacted OS:

• Any OS where the system temporary directory is shared between multiple users. This is not the case for MacOS or Windows.

Mitigation.

Moving to the Files API instead will fix this vulnerability.
https://docs.oracle.com/javase/8/docs/api/java/nio/file/Files.html#createTempFile-java.nio.file.Path-java.lang.String-java.lang.String-java.nio.file.attribute.FileAttribute...-

This API will explicitly set the posix file permissions to something safe, by default.

I recently disclosed a similar vulnerability in JUnit 4:
https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp

If you're also curious, this vulnerability in Jetty was also mine, also involving temporary directories, but is not the same vulnerability as in this case.
https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6

I would appreciate it if we could perform disclosure of this vulnerability leveraging the GitHub security advisories feature here. GitHub has a nice credit system that I appreciate, plus the disclosures, as you can see from the sampling above, end up looking very nice.
https://github.com/netty/netty/security/advisories

This vulnerability disclosure follows Google's 90-day vulnerability disclosure policy (I'm not an employee of Google, I just like their policy). Full disclosure will occur either at the end of the 90-day deadline or whenever a patch is made widely available, whichever occurs first.

Cheers,
Jonathan Leitschuh

When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled.

The CVSSv3.1 score of this vulnerability is calculated to be a 6.2/10

CVE-2021-21290 has a CVSS score of 6.2 (Medium). The vector is requires local access, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.1.59.Final); upgrading removes the vulnerable code path.

Kodem intelligence

This has been patched in version 4.1.59.Final.

1. What is CVE-2021-21290? CVE-2021-21290 is a medium-severity security vulnerability in io.netty:netty-codec-http (maven), affecting versions >= 4.0.0, < 4.1.59.Final. It is fixed in 4.1.59.Final.
2. How severe is CVE-2021-21290? CVE-2021-21290 has a CVSS score of 6.2 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which packages are affected by CVE-2021-21290?
   • io.netty:netty-codec-http (maven) (versions >= 4.0.0, < 4.1.59.Final)
   • org.jboss.netty:netty (maven) (versions < 4.0.0)
   • io.netty:netty (maven) (versions < 4.0.0)
4. Is there a fix for CVE-2021-21290? Yes. CVE-2021-21290 is fixed in 4.1.59.Final. Upgrade to this version or later.
5. Is CVE-2021-21290 exploitable, and should I be worried? Whether CVE-2021-21290 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2021-21290 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2021-21290? Upgrade io.netty:netty-codec-http to 4.1.59.Final or later.