PT-2023-9597 · Starlette+2 · Starlette+2
Masashi Yamane
·
Published
2023-05-17
·
Updated
2025-01-09
·
CVE-2023-29159
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Starlette versions 0.13.5 through 0.27.0
Description
The issue is related to a directory traversal vulnerability in Starlette, which allows a remote unauthenticated attacker to view files in a web service built using Starlette. This is due to the incorrect limitation of the path name to a restricted directory. The vulnerability can be exploited to breach confidentiality and obtain files that should not be publicly accessible.
Recommendations
For Starlette versions 0.13.5 through 0.27.0, consider disabling the
StaticFiles directory or restricting access to it until a patch is available. As a temporary workaround, avoid using the os.path.commonprefix() function and instead use os.path.commonpath() to prevent path traversal attacks. Update to a version of Starlette that uses os.path.commonpath() to fix the issue.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Red Os
Starlette