GHSA-6h2f-wjhf-4wjx

Описание

Summary

The download_media method in Pyrofork does not sanitize filenames received from Telegram messages before using them in file path construction. This allows a remote attacker to write files to arbitrary locations on the filesystem by sending a specially crafted document with path traversal sequences (e.g., ../) or absolute paths in the filename.

Details

When downloading media, if the user does not specify a custom filename (which is the common/default usage), the method falls back to using the file_name attribute from the media object. This attribute originates from Telegram's DocumentAttributeFilename and is controlled by the message sender.

Vulnerable Code Path

Step 1: In pyrogram/methods/messages/download_media.py (lines 145-151):

When a user calls download_media(message) or download_media(message, "downloads/"), the os.path.split() returns an empty filename, causing the code to use media_file_name which is attacker-controlled.

Step 2: In pyrogram/client.py (line 1125):

The os.path.join() function does not prevent path traversal. When file_name contains ../ sequences or is an absolute path, it allows writing outside the intended download directory.

Why the existing isabs check is insufficient

The check at line 153 in download_media.py:

This check only handles absolute paths by skipping the directory prefix, but:

1. For relative paths with ../, os.path.isabs() returns False, so the check doesn't catch it
2. For absolute paths, os.path.join() in the next step will still use the absolute path directly

PoC

The following Python script demonstrates the vulnerability by simulating the exact code logic from download_media.py and client.py:

How to Run

Save the above script and run:

Expected Output

Why This Proves the Vulnerability

1. The PoC uses the exact same logic as the vulnerable code in download_media.py and client.py
2. The malicious filename ../../../tmp/malicious_file causes the path to escape from /tmp/tmpXXX/downloads/ to /tmp/malicious_file
3. Python's os.path.join() and os.path.abspath() behavior is deterministic - this will work the same way in the real library

Impact

Who is affected?

• Telegram bots or user accounts using Pyrofork that download media with default parameters
• The common usage pattern await client.download_media(message) is affected

Conditions required for exploitation

1. Attacker must be able to send messages to the victim's bot/account
2. Victim must download the media without specifying a custom filename
3. The bot process must have write permissions to the target location

Potential consequences

• Arbitrary file write to locations writable by the bot process
• Overwriting existing files could cause denial of service or configuration issues
• In specific deployment scenarios, could potentially lead to code execution (e.g., if bot runs with elevated privileges)

Recommended Fix

Add filename sanitization in download_media.py after line 151:

This ensures that only the filename component is used, stripping any directory traversal sequences or absolute paths.

Thank you for your time in reviewing this report. Please let me know if you need any additional information or clarification.