Path Traversal in NLTK WekaClassifier

Executive Summary

This vulnerability is a path traversal issue in NLTK through version 3.10.3 affecting the WekaClassifier component. Attackers can bypass path restrictions by supplying unvalidated model paths, allowing them to write files outside allowed directories or probe files via Weka JVM parameters.

Useful 0 Not Useful 0

Detection Guidance

Check for unusual file writes or reads in directories outside NLTK's allowed data roots. Inspect WekaClassifier usage in NLTK logs for unvalidated model paths passed to JVM arguments like -d or -l. Review system logs for unexpected file operations by the Weka JVM process.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to write malicious files to arbitrary locations on your system or read sensitive files outside intended directories. This could lead to file corruption, data theft, or further compromise of the system running NLTK.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed or altered.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NLTK to a patched version if available. Temporarily disable WekaClassifier usage until a fix is released. Implement additional path validation checks in applications using NLTK to restrict model file paths. Monitor for suspicious file operations in system logs.

Useful 0 Not Useful 0