{"id":"GHSA-3227-r97m-8j95","summary":"Relative Path Traversal in afire serve_static","details":"### Impact\nThis vulnerability effects the built-in afire serve_static extension allowing paths containing `//....` to bypass the previous path sanitation and request files in higher directories that should not be accessible.\n\n### Patches\nThe issue has been fixed in [afire 1.1.0](https://crates.io/crates/afire/1.1.0).\nIf you can, just update to the newest version of afire.\n\n### Workarounds\nIf you can't update afire you can simply disallow paths containing `/..` with the following middleware.\nMake sure this is the last middleware added to the server so it runs first, stopping the bad requests.\n```rust\nuse afire::prelude::*;\n\nstruct PathTraversalFix;\n\nimpl Middleware for PathTraversalFix {\n    fn pre(&self, req: Request) -\u003e MiddleRequest {\n        if req.path.replace(\"\\\\\", \"/\").contains(\"/..\") {\n            return MiddleRequest::Send(\n                Response::new()\n                    .status(400)\n                    .text(\"Paths containing `..` are not allowed\"),\n            );\n        }\n\n        MiddleRequest::Continue\n    }\n}\n```\n```rust\nlet mut server = Server::new(host, port);\nPathTraversalFix.attach(&mut server);\n```\n\n### References\nYou can read about the new changes to afire in 1.1.0 [here](https://connorcode.com/writing/afire/update-3)\n\n### For more information\nIf you have any questions or comments about this advisory you can email me or message me on discord.\n[[https://connorcode.com/contact](https://connorcode.com/contact)]","modified":"2022-04-22T20:16:45Z","published":"2022-04-22T20:16:45Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2022-04-22T20:16:45Z","nvd_published_at":null,"cwe_ids":["CWE-22","CWE-34"]},"references":[{"type":"WEB","url":"https://github.com/Basicprogrammer10/afire/security/advisories/GHSA-3227-r97m-8j95"},{"type":"WEB","url":"https://github.com/Basicprogrammer10/afire/commit/da7904c04f82e1cb43cc42eaf6a1dba072b5c921"},{"type":"PACKAGE","url":"https://github.com/Basicprogrammer10/afire"},{"type":"WEB","url":"https://github.com/Basicprogrammer10/afire/releases/tag/v1.1.0"}],"affected":[{"package":{"name":"afire","ecosystem":"crates.io","purl":"pkg:cargo/afire"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.2.1"},{"fixed":"1.1.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-3227-r97m-8j95/GHSA-3227-r97m-8j95.json"}}],"schema_version":"1.9.0"}