A directory traversal vulnerability exists in RocketMQ's automatic topic creation

[coffeehb]

Some topics need checking filtering logic

Test environmental conditions:

• RocketMQ4.6.0 The latest version
• autoCreateTopicEnable=true default setting

my computer：

• Windows7 pro x64
• JDK1.8.0_181 x6

[feng3]

666

[duhenglucky]

@coffeehb it would be better to add some filtering logic on the topic name when creating a topic.

[coffeehb]

@coffeehb it would be better to add some filtering logic on the topic name when creating a topic.
@duhenglucky
Yes, without filtering logic, an attacker can fill up any arbitrary directory on the system. Please note that this issue may exist other versions of the rocketmq, not only 4.6.0 or Windows systems.

[duhenglucky]

@coffeehb it would be better to add some filtering logic on the topic name when creating a topic.
@duhenglucky
Yes, without filtering logic, an attacker can fill up any arbitrary directory on the system. Please note that this issue may exist other versions of the rocketmq, not only 4.6.0 or Windows systems.

thanks for your reminder, and could you submit a PR to fix it?

[coffeehb]

@coffeehb it would be better to add some filtering logic on the topic name when creating a topic.
@duhenglucky
Yes, without filtering logic, an attacker can fill up any arbitrary directory on the system. Please note that this issue may exist other versions of the rocketmq, not only 4.6.0 or Windows systems.

thanks for your reminder, and could you submit a PR to fix it?

@duhenglucky

...

[coffeehb]

Hello, is there a repair plan for this vulnerability? A large number of rocketmq users are affected by this security bug. @duhenglucky

[vongosling]

@coffeehb Thanks for your report, especially for your request for a CVE ID. According to some relevant regulations, I must close it workaround. For the further process of the problem, please refer to the latest commits history. Thanks again for your submission:-)