Improper Link Resolution in Serena Before 2.0.0

Executive Summary

This vulnerability in Serena before version 2.0.0 allows attackers to access files outside the project root by exploiting symlinks. The Project.is_path_in_project() function only normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite sensitive files such as SSH keys or cloud credentials.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Serena projects for symlinks that point outside the project root. Use commands like 'find . -type l -ls' to list symlinks and 'readlink -f <symlink>' to resolve their targets. Check for unexpected file access in sensitive directories like ~/.ssh or /etc.

Useful 0 Not Useful 0

Impact Analysis

An attacker could create a malicious symlink inside a project that points to sensitive files outside the project root. If you use Serena to read or write files in that project, it could unintentionally access or modify files like SSH keys, cloud credentials, or system configuration files, leading to data breaches or system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized access to personal or health data may result in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Serena to version 2.0.0 or later to apply the patch. If upgrading is not possible, avoid using untrusted Serena projects and manually validate file paths. Disable file operations in untrusted contexts until the fix is applied.

Useful 0 Not Useful 0