Red Hat WildFly: path traversal

A path traversal flaw was found in WildFly's domain mode

implementation. The LocalFileRepository.getFile() and

getConfigurationFile() methods in

wildfly-core/deployment-repository do not validate that the

resolved file path remains within the configured repository or

configuration root directories. A remote attacker who has

obtained the slave host controller secret or compromised a slave

host controller can supply a crafted relative path containing

directory traversal sequences (e.g., ../../etc/passwd) via the

slave-DC wire protocol, causing the Domain Controller to resolve

and serve arbitrary files readable by the DC process. This leads

to unauthorized disclosure of sensitive information such as

configuration files, keystores, and system credentials.