Relative Path Traversal vulnerability in fabric-private-chaincode

How it was found

Unsanitized input from os.Args[3] : 75 CLI argument flows into os.OpenFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to open arbitrary files.

The following steps of code lines with respective code confirm the issue:

• utils/fabric/peer-cli-assist.src/peer-cli-assist.go

Data flow - 5 steps in 1 file

• Step (1,2) - Line 75:49 - os.Args[3], os.Args[3] (SOURCE) 1 - 2 [Data is 'tainted' if it comes from an insecure source such as a file, the network, or the user.]
• Step (3) - Line 85:71 - `resultPipeName
• Step (4,5) - Line 87:37 - resultPipeNameos.OpenFile(resultPipeName, os.O_APPEND|os.O_WRONLY, 0644) Line :37 - resultPipeName Line :25 - os.OpenFile(resultPipeName, os.O_APPEND|os.O_WRONLY, 0644)[the operations that must receive clean data and that you wouldn't want an attacker to be able to manipulate]

References : https://cwe.mitre.org/data/definitions/23.html

Example fixes : Link 1 Link 2 Link 3

Impact

Writing arbitrary files: Allows the attacker to create or replace existing files.