GHSA-82mf-mmh7-hxp5: 
Java vulnerability analysis and mitigation

A directory traversal vulnerability was identified in Vaadin's development mode handler, affecting versions 14.0.0 through 14.4.2 and versions 15 through 17. The vulnerability, tracked as CVE-2020-36321 and GHSA-82mf-mmh7-hxp5, was discovered in the com.vaadin:flow-server component and involves improper URL validation that could allow attackers to access files outside the intended frontend resources folder. The issue was initially reported on November 26, 2020, and was later requalified as a medium severity vulnerability on April 15, 2021 (Vaadin Security).

The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium severity) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The technical assessment indicates that the vulnerability requires network access, has high attack complexity, requires no privileges or user interaction, has unchanged scope, and potentially impacts confidentiality while having no effect on integrity or availability. The vulnerability is categorized under CWE-20 (Improper Input Validation) and CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) (GitHub Advisory).

The vulnerability exposes two primary attack vectors: first, a developer running a Vaadin application locally in development mode could have their file system exposed to an attacker by visiting a malicious website; second, if a developer runs a Vaadin application locally in development mode with external access enabled, their file system could be exposed to the outside world. This issue only affects applications running in development mode with webpack development server and does not impact applications running in production mode (Vaadin Security).

The vulnerability is exploitable when three conditions are met: the Vaadin application is not in production mode and lacks webpack-compiled frontend resources, the application has access to or allows installation of Node.js, and the application startup triggers the webpack development server. The attack complexity is rated as high, indicating that specific conditions need to be met for successful exploitation (Vaadin Security).

For affected versions, users are advised to upgrade to patched versions: Vaadin 14.0.0-14.4.2 users should upgrade to version 14.4.3 or newer, while users of Vaadin 15-17 should upgrade to version 18.0.0 or newer as these versions are no longer supported. The fix was implemented in com.vaadin:flow-server version 2.4.2 and later versions (Vaadin Security).