CVE-2021-21331: Datadog api client Local Information Disclosure Vulnerability Vulnerability
LOWCVE-2021-21331 is a LOW (CVSS 3.0) local information disclosure vulnerability vulnerability (CWE-379: Creation of Temporary File in Directory with Insecure Permissions) affecting Datadog api client libraries in the Maven ecosystem. The issue involves local information disclosure vulnerability. Remediation is available by upgrading affected packages to version 1.0.0-beta.9.
CVE-2021-21331 at a Glance
Security Impact
CVSS: 3.0
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N).
How to Fix CVE-2021-21331
To remediate this vulnerability, upgrade all affected Datadog api client dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
<dependency>
<groupId>com.datadoghq</groupId>
<artifactId>datadog-api-client</artifactId>
<version>1.0.0-beta.9</version>
</dependency>Run the following command in your project directory to verify that all resolved dependencies use the patched release:
mvn dependency:tree -Dincludes=com.datadoghqHow to Check if You Are Affected
To determine whether your Java application is affected by CVE-2021-21331, inspect your build dependencies using the Maven Dependency Plugin:
mvn dependency:tree -Dincludes=com.datadoghqAnalyze the terminal output to locate any version of Datadog api client in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.0.0-beta.9), your application is affected.
Note: The mvn dependency:tree -Dincludes=com.datadoghq command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-379: Creation of Temporary File in Directory with Insecure Permissions, where the product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file. In Datadog api client, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2021-21331 Affected Datadog api client Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
com.datadoghq:datadog-api-client
|
Maven |
≥ 1.0.0-beta.6
< 1.0.0-beta.9
|
1.0.0-beta.9
|
References
Frequently Asked Questions
What is CVE-2021-21331?
Which Datadog api client versions are affected?
What version fixes CVE-2021-21331?
Is datadog-api-client affected?
What is the CVSS score of CVE-2021-21331?
What CWE is associated with CVE-2021-21331?
How can I check Maven dependencies for CVE-2021-21331?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-2cxf-6567-7pp6",
"modified" : "2021-07-08T17:02:28Z",
"published" : "2021-03-03T23:01:17Z",
"aliases" : [ "CVE-2021-21331" ],
"summary" : "Local Information Disclosure Vulnerability",
"details" : "### Impact\nLocal information disclosure of sensitive information downloaded via the API using the API Client. \n\n### Finding\nThe Datadog API is executed on a unix-like system with multiple users. The API is used to download a file containing sensitive information. This sensitive information is exposed locally to other users. This vulnerability exists in the API Client for version 1 and 2. The method `prepareDownloadFilecreates` creates a temporary file with the permissions bits of `-rw-r--r--` on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded via the `downloadFileFromResponse` method will be visible to all other users on the local system.\n\nAnalysis of the finding determined that the affected code was unused, meaning that the exploitation likelihood is low. The unused code has been removed, effectively mitigating this issue. \n\nThis vulnerability was found due to [this query](https://lgtm.com/query/8938575359870595124/) that [Jonathan Leitschuh](https://github.com/JLLeitschuh) contributed to the Semmle QL project.\n\n### Patches\nThis issue has been patched in [version 1.0.0-beta.9](https://github.com/DataDog/datadog-api-client-java/releases/tag/datadog-api-client-1.0.0-beta.9). \n\nSee also [Remove unused downloadFile helpers](https://github.com/DataDog/datadog-api-client-java/pull/637). \n\n### Workarounds\nThe recommended workaround is to specify `java.io.tmpdir` when starting the JVM with the flag `-Djava.io.tmpdir`, specifying a path to a directory with `drw-------` permissions owned by `dd-agent`.\n\n### References\n* [CWE-378: Creation of Temporary File With Insecure Permissions](https://cwe.mitre.org/data/definitions/378.html)\n* [CWE-379: Creation of Temporary File in Directory with Insecure Permissions](https://cwe.mitre.org/data/definitions/379.html)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [DataDog/datadog-api-client-java](https://github.com/DataDog/datadog-api-client-java)\t\n* Email us at [security@datadoghq.com](mailto:security@datadoghq.com)",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Maven",
"name" : "com.datadoghq:datadog-api-client"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.0.0-beta.6"
}, {
"fixed" : "1.0.0-beta.9"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/DataDog/datadog-api-client-java/security/advisories/GHSA-2cxf-6567-7pp6"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-21331"
}, {
"type" : "WEB",
"url" : "https://github.com/DataDog/datadog-api-client-java/releases/tag/datadog-api-client-1.0.0-beta.9"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-378", "CWE-379" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2021-03-03T22:58:04Z",
"nvd_published_at" : "2021-03-03T23:15:00Z"
}
}