hyper-staticfile's improper validation of Windows paths could lead to directory traversal attack
Moderate severity
GitHub Reviewed
Published
Dec 5, 2022
to the GitHub Advisory Database
•
Updated Mar 30, 2023
Package
Affected versions
< 0.9.2
= 0.10.0-alpha.1
Patched versions
0.9.2
0.10.0-alpha.2
Description
Published to the GitHub Advisory Database
Dec 5, 2022
Reviewed
Dec 5, 2022
Last updated
Mar 30, 2023
Credits
-
tdunlap607 Analyst
Path resolution in
hyper-staticfiledidn't correctly validate Windows paths, meaning paths like/foo/bar/c:/windows/web/screen/img101.pngwould be allowed and respond with the contents ofc:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.This only impacts Windows. Linux and other unix likes are not impacted by this.
References