Routinator Path Traversal Vulnerability via Malicious Rsync URIs

A path traversal vulnerability has been identified in Routinator versions prior to and including 0.15.1. The issue arises because Routinator fails to properly validate the module component of rsync URIs. These URIs are used to generate file system paths for the Routinator cache. As a result, an attacker could craft a module name containing '..' to traverse directories, potentially gaining access to the entire Routinator rsync cache.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the Routinator rsync cache, allowing an attacker to manipulate or retrieve cached data.

Remediation

Users are advised to upgrade to Routinator version 0.15.2 or later.