CVE-2020-7647: 
Java vulnerability analysis and mitigation

A Path Traversal vulnerability (CVE-2020-7647) was identified in Jooby affecting all versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby. The vulnerability allows an attacker to access arbitrary classpath resources including .properties and .class files (GitHub Advisory).

The vulnerability exists in the AssetHandler component when exposing a file system directory. If a file does not exist or the normalized name is outside of Jooby's base directory, the classpath is also searched in classloader.getResource(). This allows attackers to access URLs such as http://server/static/WEB-INF/web.xml, which will make Jooby search the /static path for the referenced file and if not found, search the classpath for /WEB-INF/web.xml instead. The vulnerability has a CVSS v3 Base Score of 5.3 (Medium) (AttackerKB).

This vulnerability can lead to Classpath Resource Disclosure, allowing attackers to access any configuration file or even the application class files. Even when assets are configured for certain extensions, attackers can bypass this restriction. For example, with assets configured as '/static/**/*.js', an attacker can still access application bytecode by sending requests like http://localhost:8080/static/io/yiss/App.class.js (GitHub Advisory).

The vulnerability has been patched in versions 1.6.7 and 2.8.2. Users should upgrade to these patched versions to mitigate the risk (GitHub Advisory).