Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1xcnFxLTljNjMteGZyZ84AAt79

tower-http's improper validation of Windows paths could lead to directory traversal attack

tower_http::services::fs::ServeDir didn't correctly validate Windows paths, meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.

This only impacts Windows. Linux and other unix likes are not impacted by this.

See tower-http#204 for more details.

Permalink: https://github.com/advisories/GHSA-qrqq-9c63-xfrg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xcnFxLTljNjMteGZyZ84AAt79
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: 11 months ago

Identifiers: GHSA-qrqq-9c63-xfrg
References:

• https://github.com/tower-rs/tower-http/pull/204
• https://rustsec.org/advisories/RUSTSEC-2022-0043.html
• https://github.com/advisories/GHSA-qrqq-9c63-xfrg

Repository: https://github.com/tower-rs/tower-http
Blast Radius: 0.0

Affected Packages