Headline
GHSA-qrqq-9c63-xfrg: tower-http's improper validation of Windows paths could lead to directory traversal attack
tower_http::services::fs::ServeDir didn’t correctly validate Windows paths, meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.
See tower-http#204 for more details.
- GitHub Advisory Database
- GitHub Reviewed
- GHSA-qrqq-9c63-xfrg
tower-http’s improper validation of Windows paths could lead to directory traversal attack
High severity GitHub Reviewed Published Aug 11, 2022
Package
cargo tower-http (Rust)
Affected versions
= 0.2.0
< 0.1.3
Patched versions
0.2.1
0.1.3
Description
tower_http::services::fs::ServeDir didn’t correctly validate Windows paths, meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.
See tower-http#204 for more details.
References
- tower-rs/tower-http#204
- https://rustsec.org/advisories/RUSTSEC-2022-0043.html
GHSA ID
GHSA-qrqq-9c63-xfrg
Source code