{"id":"GHSA-3227-r97m-8j95","aliases":[],"url":"https://o3.security/vulnerability/GHSA-3227-r97m-8j95","summary":"Relative Path Traversal in afire serve_static","details":"### Impact\nThis vulnerability effects the built-in afire serve_static extension allowing paths containing `//....` to bypass the previous path sanitation and request files in higher directories that should not be accessible.\n\n### Patches\nThe issue has been fixed in [afire 1.1.0](https://crates.io/crates/afire/1.1.0).\nIf you can, just update to the newest version of afire.\n\n### Workarounds\nIf you can't update afire you can simply disallow paths containing `/..` with the following middleware.\nMake sure this is the last middleware added to the server so it runs first, stopping the bad requests.\n```rust\nuse afire::prelude::*;\n\nstruct PathTraversalFix;\n\nimpl Middleware for PathTraversalFix {\n    fn pre(&self, req: Request) -> MiddleRequest {\n        if req.path.replace(\"\\\\\", \"/\").contains(\"/..\") {\n            return MiddleRequest::Send(\n                Response::new()\n                    .status(400)\n                    .text(\"Paths containing `..` are not allowed\"),\n            );\n        }\n\n        MiddleRequest::Continue\n    }\n}\n```\n```rust\nlet mut server = Server::new(host, port);\nPathTraversalFix.attach(&mut server);\n```\n\n### References\nYou can read about the new changes to afire in 1.1.0 [here](https://connorcode.com/writing/afire/update-3)\n\n### For more information\nIf you have any questions or comments about this advisory you can email me or message me on discord.\n[[https://connorcode.com/contact](https://connorcode.com/contact)]","published":"2022-04-22T20:16:45Z","modified":"2022-04-22T20:16:45Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"afire","fixedVersion":"1.1.0"}],"fix":{"url":"https://github.com/Basicprogrammer10/afire/commit/da7904c04f82e1cb43cc42eaf6a1dba072b5c921","label":"Basicprogrammer10/afire@da7904c"},"references":[{"type":"WEB","url":"https://github.com/Basicprogrammer10/afire/security/advisories/GHSA-3227-r97m-8j95"},{"type":"WEB","url":"https://github.com/Basicprogrammer10/afire/commit/da7904c04f82e1cb43cc42eaf6a1dba072b5c921"},{"type":"PACKAGE","url":"https://github.com/Basicprogrammer10/afire"},{"type":"WEB","url":"https://github.com/Basicprogrammer10/afire/releases/tag/v1.1.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2022-04-22T20:16:45Z"}}