Description

This vulnerability detector identifies Java applications that use original filenames from multipart file uploads directly as S3 object keys without proper sanitization. This creates a path traversal vulnerability where attackers can manipulate filenames to access or overwrite files outside the intended directory structure in S3 buckets, potentially leading to data exposure or unauthorized file access.

Detection Strategy

• Scans Java source code that imports both multipart file handling libraries (javax.servlet.http.Part, org.springframework.web.multipart, etc.) and AWS S3 libraries (com.amazonaws.services.s3, software.amazon.awssdk.services.s3, etc.)

• Identifies method calls or operations that use S3 object keys derived from multipart file uploads

• Flags code when the original filename from a multipart upload (like Part.getSubmittedFileName() or MultipartFile.getOriginalFilename()) is used directly or indirectly as an S3 object key argument

• Reports a vulnerability when unsanitized user-controlled filenames from file uploads are passed to S3 operations, allowing potential path traversal attacks through malicious filenames containing '../' sequences or absolute paths

Vulnerable code example

import com.amazonaws.services.s3.AmazonS3;
import com.amazonaws.services.s3.AmazonS3ClientBuilder;
import com.amazonaws.services.s3.model.PutObjectRequest;
import org.springframework.web.multipart.MultipartFile;
import java.io.File;
import java.io.IOException;

public class StorageService {...

✅ Secure code example

import com.amazonaws.services.s3.AmazonS3;
import com.amazonaws.services.s3.AmazonS3ClientBuilder;
import com.amazonaws.services.s3.model.PutObjectRequest;
import org.springframework.web.multipart.MultipartFile;
import org.apache.commons.io.FilenameUtils;
import java.io.File;
import java.io.IOException;
import java.util.UUID;...