GHSA-ccc3-fvfx-mw3v

Описание

Summary

The GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from "neighboring" directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak.

Details

commonprefix compares raw strings, not path components. For:

the function returns True, incorrectly treating downloads_bak as inside downloads. Download handler:

If the client supplies an absolute path in filename (starts with / or C:/), Path(root) / filename resolves to that absolute path; the flawed is_safe_path then accepts any sibling directory whose absolute path shares the same string prefix. The ../ check does not catch this.

Which file types are retrievable: Whatever is allowed by settings.ALLOWED_EXTENSIONS

PoC

Prereqs: authenticated user; standard install. Assume:

Prepare a sibling directory with the same string prefix and a test file:

As an authenticated user, request (note the leading / in the filename and the double/triple slash after /download/ to preserve it):

Other working sibling directory names (if present):

Impact

Any authenticated user can download files (with allowed extensions) from sibling directories whose absolute paths start with the same string prefix as DWD_DIR.