Reported

January 21, 2022

Issued

August 5, 2022 (last modified: June 13, 2023)

Package

tower-http (crates.io)

Type

Vulnerability

Categories

• file-disclosure

Keywords

#directory-traversal #http

Aliases

• GHSA-qrqq-9c63-xfrg

References

• https://github.com/tower-rs/tower-http/pull/204

Patched

• >=0.2.1
• >=0.1.3, <0.2.0

Affected OSes

• windows

Description

tower_http::services::fs::ServeDir didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.

This only impacts Windows. Linux and other unix likes are not impacted by this.

See tower-http#204 for more details.

Advisory available under CC0-1.0 license.