CVE-2020-8908

Overview

Guava is a widely used set of core Java libraries developed by Google that provides utilities for collections, caching, concurrency, hashing, I/O operations, and more. One common API in Guava is com.google.common.io.Files.createTempDir(), which creates a temporary directory for use by applications.

A security vulnerability (CVE-2020-8908) has been identified in Guava affecting versions where the createTempDir() method lacks secure permission handling. Because the temporary directory is created with default, world-readable permissions on many Unix-like systems, an attacker with access to the machine could potentially read sensitive files placed there. Systems that create temporary directories using this vulnerable API without additional permission restrictions are exposed.

Per OWASP: Incorrect Permission Assignment for Critical Resource occurs when a resource is given a permission setting that provides access to a wider range of actors than required, it could lead to the exposure of sensitive information, or the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution, or sensitive user data.

This issue affects multiple versions of Google Guava guava.

‍

Details

Module Info

• Product: Google Guava
• Affected packages: guava
• Affected versions: <32.0.0
• GitHub repository: https://github.com/google/guava
• Published packages: https://central.sonatype.com/namespace/com.google.guava 
• Package manager: Maven
• Fixed In: NES for Google Guava

‍

Vulnerability Info

This low-severity vulnerability exists in the Guava library’s temporary directory creation API. The createTempDir() method constructs a directory in the default temporary file area without explicitly setting restrictive file system permissions. On Unix-like operating systems, directories created in this way inherit standard world-readable permissions, allowing any local user with access to the system to list or read files placed within.

When an application uses this method to store sensitive data in temporary directories, an attacker with local system access could view that data due to the insecure permissions. The vulnerable behavior affects all Guava versions prior to the fix.

‍

Steps To Reproduce

1. Use a Java application that depends on a Guava version before the fix and calls com.google.common.io.Files.createTempDir() to create temporary directories.
2. On a Unix-like system, run the application under a user account that writes sensitive files to the created temporary directory.
3. From another local user account on the same machine, attempt to list or read the contents of the temporary directory created by the application.
4. In affected versions, the directory and its contents will be accessible due to the world-readable default permissions. 

‍

Proof Of Concept

On a vulnerable setup, an attacker with non-privileged access to the same host can locate a temporary directory created via Files.createTempDir() by the application. Because the directory inherits permissive filesystem modes, the attacker can use simple file listing or read commands (e.g., ls and cat) to inspect its contents, disclosing any sensitive files written there. This demonstrates how insecure default directory permissions can lead to information exposure when sensitive data is placed in Guava-created temporary locations. 

‍

Mitigation

Only recent versions of Google Guava are community-supported. Only the recent community supported version will receive updates to address this issue. For more information, see here.

‍

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to supported versions of Google Guava.

• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credit

• David P. Baker

‍