GHSA-cj54-hpcc-gj6h

Описание

The file_loader performs unquote() on the file path AFTER the abspath() + startswith() security check. An attacker can use percent-encoded path traversal sequences (%2e%2e for ..) that pass the security check as literal directory names, but are then decoded to actual .. traversal sequences.

Affected code

thumbor/loaders/file_loader.py lines 28-49:

The watermark and frame filters pass their URL parameters directly to the loader without re-encoding (unlike the main image URL flow which applies quote() in imaging.py line 37).

PoC

Flow:

1. %252e%252e arrives at Tornado, decoded to %2e%2e
2. Watermark filter passes %2e%2e/%2e%2e/.../etc/passwd to file_loader
3. join(ROOT, '%2e%2e/...') = ROOT/%2e%2e/...
4. abspath() sees %2e%2e as literal dir name (no dots to resolve)
5. startswith(ROOT) = True (passes check)
6. exists() returns False (literal %2e%2e dir doesn't exist)
7. unquote() converts %2e%2e to ..
8. OS resolves .. → reads files outside ROOT

Prerequisites

• LOADER = thumbor.loaders.file_loader (or file_loader_http_fallback)
• ALLOW_UNSAFE_URL = True (this is the default)
• watermark/frame filters are enabled by default (in BUILTIN_FILTERS)

Impact

Arbitrary file read on the thumbor server. When the file is a valid image format, its content is returned in the response overlaid as a watermark. Can be used to read configuration files, secrets, private keys, etc.