CVE-2022-4244

What it actually does

Directory traversal flaw allows unauthenticated remote attackers to read arbitrary files outside the intended application directory by supplying crafted paths containing ../ sequences or absolute paths.

Why it matters to the business

Attackers may obtain application source code, configuration files, and other sensitive data stored on the server, increasing risk of credential theft, intellectual property loss, and follow-on attacks; widespread use of the library amplifies exposure across dependent applications.

How an attack unfolds

An attacker identifies an application endpoint that processes user-supplied file paths through the vulnerable plexus-utils library, then supplies malicious relative or absolute paths containing traversal sequences to retrieve files outside the intended root directory.

How to fix it

Upgrade codehaus-plexus/plexus-utils to the commit fd36d8b80ba10955ef065230571ce2be2d4c1bbb or later; validate that path-handling code no longer permits traversal sequences before redeployment.

How to confirm the fix worked

Confirm the plexus-utils library version or commit hash matches the fixed revision; test affected endpoints with known traversal payloads and verify that attempts to access parent directories are rejected.

Typical attack path

1. Discover a network-accessible application using the vulnerable plexus-utils version
2. Identify an endpoint accepting file or path parameters
3. Craft and send requests containing ../ sequences or absolute paths
4. Exfiltrate contents of sensitive files such as configuration or credentials
5. Use obtained data to escalate privileges or pivot within the environment

How to detect it

Search web server and application logs for HTTP requests containing repeated ../ sequences or absolute paths targeting file-serving endpoints; correlate with unusual file access attempts outside expected application directories.

• ../
• ..%2f
• ..%5c
• %2e%2e%2f

What your security team should do

• Immediately inventory all applications depending on plexus-utils and schedule upgrades to the fixed commit
• Implement web application firewall rules to block common traversal patterns until patches are applied
• Review and harden file-access code paths to enforce allow-listed directories only