GHSA-wwh2-r387-g5rm: tower-http's improper validation of Windows paths could lead to directory traversal attack

June 17, 2022 (updated June 13, 2023)

tower_http::services::fs::ServeDir didn’t correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem. This only impacts Windows. Linux and other unix likes are not impacted by this.

References

github.com/advisories/GHSA-wwh2-r387-g5rm
github.com/tower-rs/tower-http
github.com/tower-rs/tower-http/pull/204
rustsec.org/advisories/RUSTSEC-2021-0135.html

Code Behaviors & Features

Detect and mitigate GHSA-wwh2-r387-g5rm with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →