Path Traversal in Assimp glTF Importer

Executive Summary

This is a path traversal vulnerability in the Assimp library versions up to 6.0.6. It affects the glTF and glTF2 importers where attackers can craft malicious glTF models with buffer URIs containing '..' segments or absolute paths. When processed, these URIs allow reading arbitrary local files like /etc/passwd into the imported mesh data.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect glTF files for crafted buffer URIs containing '..' segments or absolute paths. Use tools like 'grep' to search for suspicious patterns in imported models or logs. Example: grep -r "uri" /path/to/models/ | grep -E "(\.\.|/etc/|/etc/passwd)"

Useful 0 Not Useful 0

Impact Analysis

If you use Assimp to process untrusted glTF files, attackers could exploit this to read sensitive files on your system. This includes configuration files, password databases, or other confidential data accessible by the application. The impact depends on the permissions of the user running the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations processing untrusted glTF files may face compliance violations if sensitive data is exposed.

Useful 0 Not Useful 0

Mitigation Strategies

Update Assimp to the latest version where the vulnerability is patched. If updating is not possible, disable glTF import functionality or implement strict path validation in your IOSystem handler to block traversal sequences and absolute paths.

Useful 0 Not Useful 0