Description
In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.
Remediation
References
https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2021-001.md
Related Vulnerabilities
CVE-2018-14042 Vulnerability in npm package bootstrap-sass
CVE-2020-11072 Vulnerability in npm package slp-validate
CVE-2022-2900 Vulnerability in npm package parse-url
CVE-2020-8214 Vulnerability in npm package servey
CVE-2017-0783 Vulnerability in maven package org.apache.openmeetings:openmeetings-web