From b899cefba06848273b27644733357133cd14abdc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phan=20Kochen?= Date: Wed, 30 Nov 2022 23:20:13 +0100 Subject: [PATCH] Add hyper-staticfile file disclosure on Windows (#1475) * Add hyper-staticfile file disclosure on Windows * Fix version specification Co-authored-by: Sergey "Shnatsel" Davidoff --- crates/hyper-staticfile/RUSTSEC-0000-0000.md | 24 ++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 crates/hyper-staticfile/RUSTSEC-0000-0000.md diff --git a/crates/hyper-staticfile/RUSTSEC-0000-0000.md b/crates/hyper-staticfile/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..89c2721 --- /dev/null +++ b/crates/hyper-staticfile/RUSTSEC-0000-0000.md @@ -0,0 +1,24 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "hyper-staticfile" +date = "2022-11-30" +url = "https://github.com/stephank/hyper-staticfile/issues/35" +categories = ["file-disclosure"] +keywords = ["directory traversal", "http"] + +[affected] +os = ["windows"] + +[versions] +patched = ["^0.9.2", ">= 0.10.0-alpha.2"] +``` + +# Improper validation of Windows paths could lead to directory traversal attack + +Path resolution in `hyper-staticfile` didn't correctly validate Windows paths +meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed +and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users +could potentially read files anywhere on the filesystem. + +This only impacts Windows. Linux and other unix likes are not impacted by this.