Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS03cDdjLXB2dngtMnZ4M84AAwJ3

hyper-staticfile's improper validation of Windows paths could lead to directory traversal attack

Path resolution in hyper-staticfile didn't correctly validate Windows paths, meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.

This only impacts Windows. Linux and other unix likes are not impacted by this.

Permalink: https://github.com/advisories/GHSA-7p7c-pvvx-2vx3
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03cDdjLXB2dngtMnZ4M84AAwJ3
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: over 1 year ago

Identifiers: GHSA-7p7c-pvvx-2vx3
References:

• https://github.com/stephank/hyper-staticfile/issues/35
• https://rustsec.org/advisories/RUSTSEC-2022-0069.html
• https://github.com/stephank/hyper-staticfile/pull/36
• https://github.com/stephank/hyper-staticfile/commit/1e40e31d64bc6b32e595d24074092dcf84410b2b
• https://github.com/advisories/GHSA-7p7c-pvvx-2vx3

Repository: https://github.com/stephank/hyper-staticfile
Blast Radius: 0.0

Affected Packages