OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2026-01-16 16:46:18 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add hyper-staticfile file disclosure on Windows (#1475)

Browse Source 
* Add hyper-staticfile file disclosure on Windows

* Fix version specification

Co-authored-by: Sergey "Shnatsel" Davidoff <shnatsel@gmail.com>
This commit is contained in:
Stéphan Kochen
2022-11-30 23:20:13 +01:00
committed by GitHub
parent 3ce39c743d
commit b899cefba0
1 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
crates/hyper-staticfile/RUSTSEC-0000-0000.md Normal file
View File

@@ -0,0 +1,24 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "hyper-staticfile"
date = "2022-11-30"
url = "https://github.com/stephank/hyper-staticfile/issues/35"
categories = ["file-disclosure"]
keywords = ["directory traversal", "http"]
[affected]
os = ["windows"]
[versions]
patched = ["^0.9.2", ">= 0.10.0-alpha.2"]
```
# Improper validation of Windows paths could lead to directory traversal attack
Path resolution in `hyper-staticfile` didn't correctly validate Windows paths
meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed
and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users
could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.