[SSHD-605] VirtualFileSystemFactory allows escaping from root

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.0.0
• Fix Version/s: 1.1.0, 1.3.0
• Labels: security
• Environment: Windows, JDK 7
• Assignee: Lyor Goldstein
• Reporter: Damien B
• Created: 01/Dec/15 11:56
• Updated: 15/Apr/16 19:45
• Resolved: 03/Dec/15 06:33

Description

Possibly Windows only.

I start a SFTP server like this:
sshd = SshServer.setUpDefaultServer();
[...]
sshd.setFileSystemFactory(new VirtualFileSystemFactory(myRootDir.getCanonicalPath()));
[...]
sshd.setSubsystemFactories(Arrays.<NamedFactory<Command>>asList(new SftpSubsystemFactory()));

I connect to the server with FileZilla.
Upon connexion, the files in myRooDir correctly appear under the server path '/'. But if I cd to '/c:/Windows/', the files in C:\Windows\ appear, escaping the VFS root.