CVE-2021-22440

Vulnerability

A path traversal vulnerability exists in some Huawei products, including HUAWEI Mate 20, Mate 20 Pro, Hima-L29C, Laya-AL00EP, OxfordS-AN00A, and Tony-AL00B. The vulnerability occurs because the software uses external input to construct a pathname but fails to properly validate it, allowing an attacker to bypass restricted directory checks. Affected versions include 9.0.0.195(C01E195R2P1), 9.1.0.139(C00E133R3P1), and others as listed in the advisory [1].

Exploitation

An attacker can exploit this vulnerability by providing a crafted filename that traverses outside the intended restricted directory. The attacker requires the ability to supply this filename to the vulnerable component, possibly through a write operation or file upload. No authentication is mentioned as necessary, but the advisory does not specify the precise attack vector. The exploit is of low complexity [1].

Impact

Successful exploitation allows the attacker to read files or directories that are outside the restricted parent directory, leading to information disclosure. The attacker could access sensitive data stored on the device [1].

Mitigation

Huawei has released software updates to fix this vulnerability. Users should update their devices to the resolved versions listed in the advisory, such as 11.0.0.130(C01E125R2P6) for HUAWEI Mate 20. The advisory was published on 2021-06-30 and updated on 2021-09-22 [1]. No workarounds are mentioned.