Reported

January 14, 2022

Issued

January 29, 2023 (last modified: June 13, 2023)

Package

warp (crates.io)

Type

Vulnerability

Categories

• file-disclosure

Keywords

#directory-traversal #http

Aliases

• GHSA-8v4j-7jgf-5rg9

References

• https://github.com/seanmonstar/warp/issues/937

Patched

• >=0.3.3

Affected OSes

• windows

Description

Path resolution in warp::filters::fs::dir didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.

This only impacts Windows. Linux and other unix likes are not impacted by this.

Advisory available under CC0-1.0 license.