tower-http's improper validation of Windows paths could lead to directory traversal attack

published 2022-06-17 4y ago modified 2023-06-13 3y ago

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

`tower_http::services::fs::ServeDir` didn't correctly validate Windows paths meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users could potentially read files anywhere on the filesystem. This only impacts Windows. Linux and other unix likes are not impacted by this.

Patch / fix

fixed in 1 links 1

crates.io tower-http 0.1.3, 0.2.1

github.com/tower-rs/tower-http#204 pull request

Is GHSA-wwh2-r387-g5rm in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
crates.io	tower-http	>=0.2.0, <0.2.1 <0.1.3	0.2.1 0.1.3

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

GitHub Advisory GHSA-wwh2-r387-g5rm

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.